IT Operations Discussions
All the up-time. All the nines.

Finding avarage event count by time

Tankwell
Explorer

Hey all,

Are you familiar with a way to find average event count by time?

I have an events that represents user logins.

I have to find a sequence of a few days in a raw with event count larger than 0 by username
I tried to do it with timechart command

<my search> | timechart span=1d count by username


and than to do an avg / another stat function like median on the count field, but it didn't lead to any results....

My goal is to get list of usernames which tried to access a few days in a row

Any Help?

0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @Tankwell,

Since you do not have username fields after timechart command , you cannot get any result. Please try below;

| bin _time span=1d 
| stats count by username _time 
| timechart avg(count) by username
If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @Tankwell,

Since you do not have username fields after timechart command , you cannot get any result. Please try below;

| bin _time span=1d 
| stats count by username _time 
| timechart avg(count) by username
If this reply helps you an upvote and "Accept as Solution" is appreciated.

Tankwell
Explorer

Hey,

Thanks for the fast reply 🙂

It seems to do the work  - the bin function has aggregated the events well

After that I could use the stats command successfully

Thanks 😀

Tankwell

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...