I have a certain amount of events (generated every 5 min) for a set of websites and their user base and their country.
The goal is to find the number of distinct users per hour/day/month for each website per country during the last 6 months.
So at the end it will look something like this:
Over the last 6 months:
Country1 - Website1 - 12 users/hour (or day, month)
Country1 - Website2 - 2 users/hour (or day, month)
Country3 - Website1 - 10 users/hour (or day, month)
Country2 - Website3 - 8 users/hour (or day, month)
And what would be the most appropriate chart to visualize the outcome?
I have come up with this line but i'm not sure if it gives out what i want (the hourly average)
index...
| chart count(user) as no_users by location website span=1h
You should consider to set up a scheduled report because of the bigger timeframe.
Please try following search:
|index=..
| bin span=1h _time AS hour
| stats dc(user) AS user_dc by location website hour
| stats avg(user_dc) AS avg_user_hour by location website
| eval avg_user_hour=round(avg_user_hour)
You should consider to set up a scheduled report because of the bigger timeframe.
Please try following search:
|index=..
| bin span=1h _time AS hour
| stats dc(user) AS user_dc by location website hour
| stats avg(user_dc) AS avg_user_hour by location website
| eval avg_user_hour=round(avg_user_hour)