Splunk Search

Combine values for a field by user over 24 hours

bcusick
Communicator

Hi all,

I am trying to find the average number of bytesOut for proxy activity by user. Obviously first I am pulling the number of bytesOut and all the users, so I get this:

user bytesOut
brian 100
michael 50
tom 75

My issue is that users have multiple requests, giving them multiple rows in this table, as seen here:

user bytesOut
brian 100
brian 100
michael 50
michael 50
michael 50
tom 75

I would like to combines the total number of bytesOut PER user (so brian's bytesOut=200) and then calculate whatever I need to on those fields. It's been a while since statistics class! Any help is appreciated.

Thanks,

B

Tags (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

'... | stats sum(bytesOut) as totalBytesOut by user | table user totalBytesout'

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

'... | stats sum(bytesOut) as totalBytesOut by user | table user totalBytesout'

---
If this reply helps you, Karma would be appreciated.

bcusick
Communicator

I'm justifying my brainfart to "it's friday"

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...