Splunk Search

Average sessions per hour

alaking
Explorer

I am trying to calculate the average number of sessions per hour based on "off hours" 5pm to 9 am. I have the time range and events, I just need to do the math.
This returns an empty result set:
Search here
| stats count(sessionid) as total2
| stats avg(total2) by date_hour

This returns a time chart but it's averaging the values of sessionid (which is a numeric field):
Search here | timechart span=24h per_hour(sessionid) as AvgPerHour

and finally, this returns the count per hour as expected but I'm at a loss as to how to average based on this count:
search here | stats count(sessionid) by date_hour

Thanks in advance for reading.

0 Karma
1 Solution

woodcock
Esteemed Legend

You need to chain 2 stats commands like this:

search here | bucket _time span=1h | stats dc(sessionid) AS sessionIds by _time | stats avg(sessionids)

Run this with a timepicker value that spans many hours.

View solution in original post

woodcock
Esteemed Legend

You need to chain 2 stats commands like this:

search here | bucket _time span=1h | stats dc(sessionid) AS sessionIds by _time | stats avg(sessionids)

Run this with a timepicker value that spans many hours.

alaking
Explorer

This works! Thank you for the speedy reply, I'm still trying to grasp the complexity of the search language.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...