I need help with a search.
Let's imagine we have Windows logs. These logs contain the field Username.
I want to calculate average and median for number events per second per each unique username.
Strategic goal is to form something like a baseline - "average user generates so much events per hour/day/week". And detect anomalies based on this.