Splunk Enterprise

How to calculate the average number of hours an app is used per day?

buttsurfer
Path Finder

 I have logs that get generated every 5 min.    

 

 

time=2023-02-06 00:01:00, app=bema, currentUseCount=7
time=2023-02-06 00:06:00, app=bema, currentUseCount=7
time=2023-02-06 00:11:00, app=bema, currentUseCount=10
time=2023-02-06 00:16:00, app=bema, currentUseCount=8
time=2023-02-06 00:21:00, app=ash, currentUseCount=12
time=2023-02-06 00:26:00, app=ash, currentUseCount=10
time=2023-02-06 00:31:00, app=ash, currentUseCount=8
time=2023-02-06 00:36:00, app=ash, currentUseCount=9

 

 

 How can i calculate the hours spent on each app based on the above logs 

 

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Based on the sample events shown, we know the apps were busy during the midnight hour on 6 Feb.  What we don't know is how much time the apps spent being doing work so we can't say how many hours were spent by each app.

You can use this query to see how much use each app received each hour.

 

index=foo app=* currentUseCount=*
| timechart span=1h sum(currentUseCount) as hourlyUseCount by app

 

---
If this reply helps you, Karma would be appreciated.
0 Karma

buttsurfer
Path Finder

The currentUseCount is actually the amount of users currently using the app. So if we have 

time=2023-02-06 00:01:00, app=bema, currentUseCount=7
time=2023-02-06 00:06:00, app=bema, currentUseCount=7
time=2023-02-06 00:11:00, app=bema, currentUseCount=10
time=2023-02-06 00:16:00, app=bema, currentUseCount=3

it would be calculated like 7*5minutes + 7*5minutes + 10*5minutes + 3*Xminutes

0 Karma

richgalloway
SplunkTrust
SplunkTrust

I'm not sure it's safe to say the app was busy all 5 minutes, but it's better than nothing.

index=foo app=* currentUseCount=*
| eval busyMinutes=currentUseCount * 5
| timechart span=1h sum(busyMinutes) as busyMinutes by app
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...