Splunk Search

Average Daily Unique category by Weekday for a period of 1 month

deepanram211219
New Member

I am creating a search that counts the daily unique category from a proxy log. I want to show the average number of unique website category by weekday over a month.

My issue is that I have created a successful search for 1 category but need to know how to count for different category over week days and show them on one chart.

My query:

Host=proxy1 category=business-and-economy | bin span=1d _time | stats count dc(_time) as days by date_wday | eval average_count = count / days

Tags (1)
0 Karma

Sebastian2
Path Finder

I'm not sure if I understood correctly what you are trying, but have you tried:

Host=proxy1 category=* | bin span=1d _time | stats count dc(_time) as days by date_wday, category | eval average_count = count / days
0 Karma

deepanram211219
New Member

Thanks for your reply, let me be more clear. I want to create a stacked column chart as shown below. With each colour representing a different category with the (AVG)weekday count superimposed on them.

alt text

0 Karma

deepanram211219
New Member

I ran the following query and ended up with the below result. But I would like to know how I can get the result for other categories on the same chart?

host=proxy1 category=business-and-economy | bucket _time span=1d | stats avg(count) dc(_time) as days by date_wday | eval average_count = count / days

0 Karma
Get Updates on the Splunk Community!

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...