Dashboards & Visualizations

Average page views at a user level for a given page

tmtcollins
Explorer

I have a table:

PageID, UserName, Date, count of hits to that page, 

I would like to find the average daily page hits, per article at a UserID level. (for the top 100 most frequently viewed pages)

So for example,
Person xyz, on average views page x, n number of times per day over the last week.

This is the start of the query...

 ... | bucket span=1d _time| stats count by PageID, UserName , _time | sort - count |head 100

Any help much appreciated.

Labels (1)
Tags (1)
1 Solution

woodcock
Esteemed Legend

Try this:

... | bucket span=1d _time
| stats count BY PageID, UserName , _time
| rename COMMENT AS "Calculate and keep the 100 most popular pages"
| eventstats sum(count) AS grandTotal BY PageID
| sort 0 - grandTotal
| streamstats dc(PageID) AS PageRank
| search PageRank <= 100
| rename COMMENT AS "Find avg daily hits per PageID per UserID"
| stats avg(count) AS DailyPageHits BY PageID UserID

Or, more simply this:

... | bin _time span=1h
| top limit=100 PageID BY UserID _time
| stats avg(count) AS DailyPageHits BY PageID UserID

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try this:

... | bucket span=1d _time
| stats count BY PageID, UserName , _time
| rename COMMENT AS "Calculate and keep the 100 most popular pages"
| eventstats sum(count) AS grandTotal BY PageID
| sort 0 - grandTotal
| streamstats dc(PageID) AS PageRank
| search PageRank <= 100
| rename COMMENT AS "Find avg daily hits per PageID per UserID"
| stats avg(count) AS DailyPageHits BY PageID UserID

Or, more simply this:

... | bin _time span=1h
| top limit=100 PageID BY UserID _time
| stats avg(count) AS DailyPageHits BY PageID UserID
0 Karma

tmtcollins
Explorer

Amazing thank you sir.

Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...