Splunk Search

How do I create a timechart with the average of total events/count of users per hour?

Builder

Hi all.

I have a sourcetype with a lot of events. I want to prepare a timechart that present the total events per hour divided in the count of users to present the average of events per hour according to the number of users. My user field is user_id.

I tried presenting the events per hour as | timechart count by user_id span=1h and other combinations, but I don't know how can operate the timechart against the total count of users.

Any can please help me?

Regards,

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Not sure if I understood what you are looking for but give this a go:

yoursearch
| fields _time, user_id
| eventstats dc(user_id) as total_users
| timechart span=1h count, first(total_users) as total_users
| eval count = round(count / total_users, 2)
| fields - total_users

View solution in original post

SplunkTrust
SplunkTrust

I think it's just

<your search terms>
| timechart span=1h count as events dc(user_id) as users
| eval events_per_user=events/users
| fields - events users

SplunkTrust
SplunkTrust

Not sure if I understood what you are looking for but give this a go:

yoursearch
| fields _time, user_id
| eventstats dc(user_id) as total_users
| timechart span=1h count, first(total_users) as total_users
| eval count = round(count / total_users, 2)
| fields - total_users

View solution in original post

Builder

This is exactly! Thanks a lot.

0 Karma

Builder

Hello. Some way to improve to only count the quantity of users with activity in the related hour? I mean, if i have from 8am to 9am only 23 users active (not the total sum of users per day).
Thanks!

0 Karma

SplunkTrust
SplunkTrust

Hi,

As @sideview mentioned below, it should be as simple as:

yoursearch
 | fields _time, user_id
 | timechart span=1h count as events, dc(user_id) as users
 | eval events_per_user=events/users
 | fields - events users
0 Karma