Dashboards & Visualizations

Average page views at a user level for a given page

tmtcollins
Explorer

I have a table:

PageID, UserName, Date, count of hits to that page, 

I would like to find the average daily page hits, per article at a UserID level. (for the top 100 most frequently viewed pages)

So for example,
Person xyz, on average views page x, n number of times per day over the last week.

This is the start of the query...

 ... | bucket span=1d _time| stats count by PageID, UserName , _time | sort - count |head 100

Any help much appreciated.

Labels (1)
Tags (1)
1 Solution

woodcock
Esteemed Legend

Try this:

... | bucket span=1d _time
| stats count BY PageID, UserName , _time
| rename COMMENT AS "Calculate and keep the 100 most popular pages"
| eventstats sum(count) AS grandTotal BY PageID
| sort 0 - grandTotal
| streamstats dc(PageID) AS PageRank
| search PageRank <= 100
| rename COMMENT AS "Find avg daily hits per PageID per UserID"
| stats avg(count) AS DailyPageHits BY PageID UserID

Or, more simply this:

... | bin _time span=1h
| top limit=100 PageID BY UserID _time
| stats avg(count) AS DailyPageHits BY PageID UserID

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try this:

... | bucket span=1d _time
| stats count BY PageID, UserName , _time
| rename COMMENT AS "Calculate and keep the 100 most popular pages"
| eventstats sum(count) AS grandTotal BY PageID
| sort 0 - grandTotal
| streamstats dc(PageID) AS PageRank
| search PageRank <= 100
| rename COMMENT AS "Find avg daily hits per PageID per UserID"
| stats avg(count) AS DailyPageHits BY PageID UserID

Or, more simply this:

... | bin _time span=1h
| top limit=100 PageID BY UserID _time
| stats avg(count) AS DailyPageHits BY PageID UserID
0 Karma

tmtcollins
Explorer

Amazing thank you sir.

Get Updates on the Splunk Community!

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...