Splunk Search

How to search the count and average count of events per hour?

shellnight
Explorer

Hello

Please can you provide a search for getting the number of events per hour and average count per hour?

Tags (1)
0 Karma
1 Solution

lloydd518
Path Finder

Hi

As per this question http://answers.splunk.com/answers/90569/event-count-per-user-per-hour.html

sourcetype=your_sourcetype earliest=-48h latest=-24h | bucket _time span=1h | stats count by _time | sort - count

This will count the events per hour between 48 hours ago to 24 hours ago... (change this as you see fit or remove earliest and latest)

If you want to average all of those results, you would add the stats avg(count) at the end of the search:

sourcetype=your_sourcetype earliest=-48h latest=-24h | bucket _time span=1h | stats count by _time | stats avg(count)

This will average out the number of events per hour...

If you have a specific event you are looking for, that would go at the beginning:

sourcetype=your_sourcetype earliest=-48h latest=-24h   some_thing_that_I'm_trying_to_match    | bucket _time span=1h | stats count by _time | sort - count

sourcetype=your_sourcetype earliest=-48h latest=-24h   some_thing_that_I'm_trying_to_match    | bucket _time span=1h | stats count by _time | stats avg(count)

View solution in original post

lloydd518
Path Finder

Hi

As per this question http://answers.splunk.com/answers/90569/event-count-per-user-per-hour.html

sourcetype=your_sourcetype earliest=-48h latest=-24h | bucket _time span=1h | stats count by _time | sort - count

This will count the events per hour between 48 hours ago to 24 hours ago... (change this as you see fit or remove earliest and latest)

If you want to average all of those results, you would add the stats avg(count) at the end of the search:

sourcetype=your_sourcetype earliest=-48h latest=-24h | bucket _time span=1h | stats count by _time | stats avg(count)

This will average out the number of events per hour...

If you have a specific event you are looking for, that would go at the beginning:

sourcetype=your_sourcetype earliest=-48h latest=-24h   some_thing_that_I'm_trying_to_match    | bucket _time span=1h | stats count by _time | sort - count

sourcetype=your_sourcetype earliest=-48h latest=-24h   some_thing_that_I'm_trying_to_match    | bucket _time span=1h | stats count by _time | stats avg(count)

shellnight
Explorer

THANK YOU VERY MUCH !!!

0 Karma
Get Updates on the Splunk Community!

Bridging the Gap: Splunk Helps Students Move from Classroom to Career

The Splunk Community is a powerful network of users, educators, and organizations working together to tackle ...

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...