Splunk Enterprise

How to calculate the average number of hours an app is used per day?

buttsurfer
Path Finder

 I have logs that get generated every 5 min.    

 

 

time=2023-02-06 00:01:00, app=bema, currentUseCount=7
time=2023-02-06 00:06:00, app=bema, currentUseCount=7
time=2023-02-06 00:11:00, app=bema, currentUseCount=10
time=2023-02-06 00:16:00, app=bema, currentUseCount=8
time=2023-02-06 00:21:00, app=ash, currentUseCount=12
time=2023-02-06 00:26:00, app=ash, currentUseCount=10
time=2023-02-06 00:31:00, app=ash, currentUseCount=8
time=2023-02-06 00:36:00, app=ash, currentUseCount=9

 

 

 How can i calculate the hours spent on each app based on the above logs 

 

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Based on the sample events shown, we know the apps were busy during the midnight hour on 6 Feb.  What we don't know is how much time the apps spent being doing work so we can't say how many hours were spent by each app.

You can use this query to see how much use each app received each hour.

 

index=foo app=* currentUseCount=*
| timechart span=1h sum(currentUseCount) as hourlyUseCount by app

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

buttsurfer
Path Finder

The currentUseCount is actually the amount of users currently using the app. So if we have 

time=2023-02-06 00:01:00, app=bema, currentUseCount=7
time=2023-02-06 00:06:00, app=bema, currentUseCount=7
time=2023-02-06 00:11:00, app=bema, currentUseCount=10
time=2023-02-06 00:16:00, app=bema, currentUseCount=3

it would be calculated like 7*5minutes + 7*5minutes + 10*5minutes + 3*Xminutes

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm not sure it's safe to say the app was busy all 5 minutes, but it's better than nothing.

index=foo app=* currentUseCount=*
| eval busyMinutes=currentUseCount * 5
| timechart span=1h sum(busyMinutes) as busyMinutes by app
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...