How to search the average and median of the number of events per second for each unique username?

[ibondarets]

Hello!

I need help with a search.
Let's imagine we have Windows logs. These logs contain the field Username.
I want to calculate average and median for number events per second per each unique username.
Strategic goal is to form something like a baseline - "average user generates so much events per hour/day/week". And detect anomalies based on this.

How can I do it?

[somesoni2]

Try something like this. Below should give you events per second for each user.

your base search to get windows logs with field _time and Username | bucket span=1s _time | stats count as eps by _time Username 

Now to calculate avg and median eps per hour/day/week, try like this

above search | bucket span=1h _time | stats avg(eps) as avg_eps median(eps) as median_eps by _time user

Change the span to 1h for hour, 1d for day and 1w for week.