Splunk Search

Combine values for a field by user over 24 hours

Communicator

Hi all,

I am trying to find the average number of bytesOut for proxy activity by user. Obviously first I am pulling the number of bytesOut and all the users, so I get this:

user bytesOut
brian 100
michael 50
tom 75

My issue is that users have multiple requests, giving them multiple rows in this table, as seen here:

user bytesOut
brian 100
brian 100
michael 50
michael 50
michael 50
tom 75

I would like to combines the total number of bytesOut PER user (so brian's bytesOut=200) and then calculate whatever I need to on those fields. It's been a while since statistics class! Any help is appreciated.

Thanks,

B

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

'... | stats sum(bytesOut) as totalBytesOut by user | table user totalBytesout'

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

'... | stats sum(bytesOut) as totalBytesOut by user | table user totalBytesout'

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Communicator

I'm justifying my brainfart to "it's friday"

0 Karma