Splunk Search

Calculate time avg time and std deviation between log entries

tradecraft1914
Explorer

I am trying to average calculate the time between web log entries. If an IP on the network visits the same URL multiple times in a given time period we want to calculate the average time between visits. I cant really do a transaction (at least I dont think so) because the events are the same..no begin or end.

I have a search that groups the IP's that visit a URL more than once and also grabs the log entries for each time the URL is visited.

The fields in the output are:

Timestamp, Src_IP, URL, Count

Now for the fun part. Once average time is calculated we want to calculate standard deviation.

Any help would be greatly appreciated!

Tags (1)

gkanapathy
Splunk Employee
Splunk Employee

Use streamstats

   sourcetype=myweblog 
   | streamstats window=1 global=f current=f
       last(Timestamp) as next_ts
     by Src_IP,URL
   | eval tm_to_next=next_ts-Timestamp
   | stats 
       avg(tm_to_next)
       stdev(tm_to_next)
     by Src_IP,URL 
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...