Splunk Search

Average Weekly Value

henryt1
Path Finder

So I was unable to find an answer on here that helped with what I'm trying to do. When I run the following query I get a single number of logins per week.

host="web01.inno-360.com" AND source="/var/log/apache2/pg_ssl_access.log" AND \/projects\/*\/talent-ecosystems\/createlist | stats count by source

However I am also wanting to find out what the average number of logins is (per week) since the beginning of the year. Would anyone know how to do this? Thanks in advance.

Tags (2)
0 Karma

Sarmbrister
Path Finder

I know this is an old post, but I created the below search query below. Should work for anyone looking for their average over the past 7 days. It's a big ugly search and I'm sure there is a way to simply this or to heavily utilize eval but this is what I ended up with. Hope it helps everyone.
index=_internal source=*license_usage.log type=usage

| eval GB = b/1024/1024/1024

| timechart span=1d sum(GB) by pool

| eval Time=strftime(_time, "%m/%d/%Y")

| fieldformat auto_generated_pool_enterprise=tostring(auto_generated_pool_enterprise, "commas"). " GB"

| fields - _time

| addcoltotals auto_generated_pool_enterprise label=Total labelfield=weeklytotal
| fields Time,auto_generated_pool_enterprise, weeklytotal
| search weeklytotal=Total auto_generated_pool_enterprise>1*GB
| eval weekly_average=(auto_generated_pool_enterprise/7)
|eval Total_weekly_average=round(weekly_average,2)
| table Total_weekly_average
| rename Total_weekly_average AS "Average over the past 7 days"

0 Karma

sowings
Splunk Employee
Splunk Employee

I'd use an eval to set a new variable to the week number (see strftime and %V), then use that value as the "by" field in a stats command.

0 Karma

sowings
Splunk Employee
Splunk Employee

Something like "search=foo ... | stats command_to_get_daily_count | eval wnum=strftime(_time, "%V") | stats avg(count) by wnum"

0 Karma

henryt1
Path Finder

Thank you for the input, I've never used eval before (I'm new to Splunk) so what would that query look like?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...