Splunk Search

How to get hourly count, average and standard deviation over days?

IvyZhang
New Member

I want to create a table of count metrics based on hour of the day. So average and stdev of distinct UID at 7:00, 8:00, 9:00, etc.
For example, from 7:00-7:59AM, there are 2 users on Nov 1, 5 users on Nov 2, 6 users on Nov 3,....
I want to see the average and stdev number of users at 7:00-7:59 from Nov 1 to Nov 30.

I can't get standard deviation by using this command. How should I do it???
...|stats dc(UID) as DistinctUID by date_hour, date_mday|stats avg(DistinctUID) stdev(DistinctUID) by date_hour

Thanks!!

0 Karma

ppablo
Community Manager
Community Manager

Hi @IvyZhang

Did @martin_mueller's answer solve your question?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Try something like this:

base search | timechart span=1h dc(UID) as DistinctUID | eval hour_of_day = strftime(_time, "%H") | eventstats avg(DistinctUID) as hourly_average stdev(DistinctUID) as hourly_stdev by hour_of_day | fields - hour_of_day