Splunk Search

Calculate time avg time and std deviation between log entries

tradecraft1914
Explorer

I am trying to average calculate the time between web log entries. If an IP on the network visits the same URL multiple times in a given time period we want to calculate the average time between visits. I cant really do a transaction (at least I dont think so) because the events are the same..no begin or end.

I have a search that groups the IP's that visit a URL more than once and also grabs the log entries for each time the URL is visited.

The fields in the output are:

Timestamp, Src_IP, URL, Count

Now for the fun part. Once average time is calculated we want to calculate standard deviation.

Any help would be greatly appreciated!

Tags (1)

gkanapathy
Splunk Employee
Splunk Employee

Use streamstats

   sourcetype=myweblog 
   | streamstats window=1 global=f current=f
       last(Timestamp) as next_ts
     by Src_IP,URL
   | eval tm_to_next=next_ts-Timestamp
   | stats 
       avg(tm_to_next)
       stdev(tm_to_next)
     by Src_IP,URL 
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...