How do I divide the number of calls to a page by number of jsessionds?

[selvig]

I'm looking at Apache access logs for a Java application and on some occasions we see large numbers of calls to a particular page, basket.do, per session. We've worked out a good start search:
sourcetype=access_* uri="/basket.do" |stats count by JSESSIONID |SORT by count desc to show us the JSESSIONIDs that make the most calls. I want to get an average of /basket.do calls per JSESSIONID per hour.

[sdaniels · Accepted solution]

sourcetype=access_* uri="/basket.do" | bucket span=1h _time | stats count by uri,_time, JSESSIONID | stats count avg(count) by _time

Not sure i have good data for this but let me know if this is what you need. I think the avg is what you want. Take a look at it without the final stats command...let me know if this is on the right track.

[selvig]

That does it! Thank you.

[Damien_Dallimor]

Does this work for you :

sourcetype=access_* uri="/basket.do" | bucket span=1h _time | stats count by JSESSIONID,_time | stats avg(count) as "Avg Per Hour" by JSESSIONID | sort by "Avg Per Hour" desc

[mwhite_splunk]

Have you tried something like this:

sourcetype=access_* uri="/basket.do" | stats count by JSESSIONID AS jsess_avg | chart avg(jsess_avg)

I'm kind of shooting in the dark as I don't have a data set to test it.

[selvig]

That's bringing back what looks like an hourly sum of JSESSIONIDs which have basket.do calls. I need the sum of /basket.do calls, divided by the number of unique JSESSIONIDs.