I'm looking at Apache access logs for a Java application and on some occasions we see large numbers of calls to a particular page, basket.do, per session. We've worked out a good start search:
sourcetype=access_* uri="/basket.do" |stats count by JSESSIONID |SORT by count desc to show us the JSESSIONIDs that make the most calls. I want to get an average of /basket.do calls per JSESSIONID per hour.
Have you tried something like this:
sourcetype=access_* uri="/basket.do" | stats count by JSESSIONID AS jsess_avg | chart avg(jsess_avg)
I'm kind of shooting in the dark as I don't have a data set to test it.
That's bringing back what looks like an hourly sum of JSESSIONIDs which have basket.do calls. I need the sum of /basket.do calls, divided by the number of unique JSESSIONIDs.
Does this work for you :
sourcetype=access_* uri="/basket.do" | bucket span=1h _time | stats count by JSESSIONID,_time | stats avg(count) as "Avg Per Hour" by JSESSIONID | sort by "Avg Per Hour" desc
sourcetype=access* uri="/basket.do" | bucket span=1h _time | stats count by uri,time, JSESSIONID | stats count avg(count) by _time
Not sure i have good data for this but let me know if this is what you need. I think the avg is what you want. Take a look at it without the final stats command...let me know if this is on the right track.