Splunk Search

Count the number of different value of a field, and get the average per minute

zonglin123
New Member

I have some domain like this:

domain |
A |
B |
C |
D |
......


One domain can be called in one request, now I want to know what is the average request number per minute for a domain (no matter what domain is). So I split it into three steps:
1) get the total request number per minute
2) get the number of domains been called per minute
3) avg = total request number per minute / number of domain per minute

I have got the result of the first step by:
```
index="whatever" source="sourceurl"
| bin _time span=1m
| stats count as requestsPerMin by _time
```

However, I don't know how to get the number of domains that been called. For example, in a minute, domain A has been called twice, domain B has been called once, so the number of domains that been called should be two. But I don't know which query can get this result.

I appreciate it if someone can help, sorry if it is duplicated.

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the distinct_count (dc) function instead of count in stats.

---
If this reply helps you, Karma would be appreciated.
0 Karma

bowesmana
SplunkTrust
SplunkTrust

@zonglin123 

| stats count as requestsPerMin dc(domain) as domains by _time

dc=distinct count 

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...