Splunk Search

Average Hits per Minute by Distinct SourceIP

mattreidy
Engager

I'm interested to know the average hits per minute by distinct source IP address from my web log data for a given time period.

(I'm sure this is REALLY simple but I've yet to figure it out...)

Thanks!

Tags (1)

tgow
Splunk Employee
Splunk Employee

Is the search you are looking for:

... | bucket _time span=1m | stats dc(clientip) as dcip count(clientip) as totalcount by _time | eval avg_hit=(totalcount/dcip) | fields + _time, avg_hit

gkanapathy
Splunk Employee
Splunk Employee

Sounds to me like you really want the count of distinct source IPs, not the count by each source IP.

... | timechart span=1m distinct_count(src_ip)

dwaddle
SplunkTrust
SplunkTrust

This sounds like a good use of timechart, something like

my_search | timechart useother=false span=1m count(_raw) by src_ip

gkanapathy
Splunk Employee
Splunk Employee

The above is giving you the count of hits per distinct src_ip. But I suppose what you want is the count of distinct src_ip values, which is ... | timechart span=1m distinct_count(src_ip)

dwaddle
SplunkTrust
SplunkTrust

So lemme see here matt -- are you looking to reduce this to a single value per time period that is the avg# of per-ip hits? If so, the above search should be easily adjustable to do that. Please advise.

0 Karma

mattreidy
Engager

This gives me the raw count, but what I'm really after is the average of the count per IP...

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!