Dashboards & Visualizations

Average page views at a user level for a given page

tmtcollins
Explorer

I have a table:

PageID, UserName, Date, count of hits to that page, 

I would like to find the average daily page hits, per article at a UserID level. (for the top 100 most frequently viewed pages)

So for example,
Person xyz, on average views page x, n number of times per day over the last week.

This is the start of the query...

 ... | bucket span=1d _time| stats count by PageID, UserName , _time | sort - count |head 100

Any help much appreciated.

Labels (1)
Tags (1)
1 Solution

woodcock
Esteemed Legend

Try this:

... | bucket span=1d _time
| stats count BY PageID, UserName , _time
| rename COMMENT AS "Calculate and keep the 100 most popular pages"
| eventstats sum(count) AS grandTotal BY PageID
| sort 0 - grandTotal
| streamstats dc(PageID) AS PageRank
| search PageRank <= 100
| rename COMMENT AS "Find avg daily hits per PageID per UserID"
| stats avg(count) AS DailyPageHits BY PageID UserID

Or, more simply this:

... | bin _time span=1h
| top limit=100 PageID BY UserID _time
| stats avg(count) AS DailyPageHits BY PageID UserID

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try this:

... | bucket span=1d _time
| stats count BY PageID, UserName , _time
| rename COMMENT AS "Calculate and keep the 100 most popular pages"
| eventstats sum(count) AS grandTotal BY PageID
| sort 0 - grandTotal
| streamstats dc(PageID) AS PageRank
| search PageRank <= 100
| rename COMMENT AS "Find avg daily hits per PageID per UserID"
| stats avg(count) AS DailyPageHits BY PageID UserID

Or, more simply this:

... | bin _time span=1h
| top limit=100 PageID BY UserID _time
| stats avg(count) AS DailyPageHits BY PageID UserID
0 Karma

tmtcollins
Explorer

Amazing thank you sir.

Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...