Splunk Search

Count the number of different value of a field, and get the average per minute

zonglin123
New Member

I have some domain like this:

domain |
A |
B |
C |
D |
......


One domain can be called in one request, now I want to know what is the average request number per minute for a domain (no matter what domain is). So I split it into three steps:
1) get the total request number per minute
2) get the number of domains been called per minute
3) avg = total request number per minute / number of domain per minute

I have got the result of the first step by:
```
index="whatever" source="sourceurl"
| bin _time span=1m
| stats count as requestsPerMin by _time
```

However, I don't know how to get the number of domains that been called. For example, in a minute, domain A has been called twice, domain B has been called once, so the number of domains that been called should be two. But I don't know which query can get this result.

I appreciate it if someone can help, sorry if it is duplicated.

 

Labels (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Use the distinct_count (dc) function instead of count in stats.

---
If this reply helps you, Karma would be appreciated.
0 Karma

bowesmana
SplunkTrust
SplunkTrust

@zonglin123 

| stats count as requestsPerMin dc(domain) as domains by _time

dc=distinct count 

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...