Splunk Search

Average Weekly Value

henryt1
Path Finder

So I was unable to find an answer on here that helped with what I'm trying to do. When I run the following query I get a single number of logins per week.

host="web01.inno-360.com" AND source="/var/log/apache2/pg_ssl_access.log" AND \/projects\/*\/talent-ecosystems\/createlist | stats count by source

However I am also wanting to find out what the average number of logins is (per week) since the beginning of the year. Would anyone know how to do this? Thanks in advance.

Tags (2)
0 Karma

Sarmbrister
Path Finder

I know this is an old post, but I created the below search query below. Should work for anyone looking for their average over the past 7 days. It's a big ugly search and I'm sure there is a way to simply this or to heavily utilize eval but this is what I ended up with. Hope it helps everyone.
index=_internal source=*license_usage.log type=usage

| eval GB = b/1024/1024/1024

| timechart span=1d sum(GB) by pool

| eval Time=strftime(_time, "%m/%d/%Y")

| fieldformat auto_generated_pool_enterprise=tostring(auto_generated_pool_enterprise, "commas"). " GB"

| fields - _time

| addcoltotals auto_generated_pool_enterprise label=Total labelfield=weeklytotal
| fields Time,auto_generated_pool_enterprise, weeklytotal
| search weeklytotal=Total auto_generated_pool_enterprise>1*GB
| eval weekly_average=(auto_generated_pool_enterprise/7)
|eval Total_weekly_average=round(weekly_average,2)
| table Total_weekly_average
| rename Total_weekly_average AS "Average over the past 7 days"

0 Karma

sowings
Splunk Employee
Splunk Employee

I'd use an eval to set a new variable to the week number (see strftime and %V), then use that value as the "by" field in a stats command.

0 Karma

sowings
Splunk Employee
Splunk Employee

Something like "search=foo ... | stats command_to_get_daily_count | eval wnum=strftime(_time, "%V") | stats avg(count) by wnum"

0 Karma

henryt1
Path Finder

Thank you for the input, I've never used eval before (I'm new to Splunk) so what would that query look like?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...