Splunk Search

How do I create a timechart with the average of total events/count of users per hour?

changux
Builder

Hi all.

I have a sourcetype with a lot of events. I want to prepare a timechart that present the total events per hour divided in the count of users to present the average of events per hour according to the number of users. My user field is user_id.

I tried presenting the events per hour as | timechart count by user_id span=1h and other combinations, but I don't know how can operate the timechart against the total count of users.

Any can please help me?

Regards,

0 Karma
1 Solution

javiergn
Super Champion

Not sure if I understood what you are looking for but give this a go:

yoursearch
| fields _time, user_id
| eventstats dc(user_id) as total_users
| timechart span=1h count, first(total_users) as total_users
| eval count = round(count / total_users, 2)
| fields - total_users

View solution in original post

sideview
SplunkTrust
SplunkTrust

I think it's just

<your search terms>
| timechart span=1h count as events dc(user_id) as users
| eval events_per_user=events/users
| fields - events users

javiergn
Super Champion

Not sure if I understood what you are looking for but give this a go:

yoursearch
| fields _time, user_id
| eventstats dc(user_id) as total_users
| timechart span=1h count, first(total_users) as total_users
| eval count = round(count / total_users, 2)
| fields - total_users

changux
Builder

This is exactly! Thanks a lot.

0 Karma

changux
Builder

Hello. Some way to improve to only count the quantity of users with activity in the related hour? I mean, if i have from 8am to 9am only 23 users active (not the total sum of users per day).
Thanks!

0 Karma

javiergn
Super Champion

Hi,

As @sideview mentioned below, it should be as simple as:

yoursearch
 | fields _time, user_id
 | timechart span=1h count as events, dc(user_id) as users
 | eval events_per_user=events/users
 | fields - events users
0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...