- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hello
Please can you provide a search for getting the number of events per hour and average count per hour?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
As per this question http://answers.splunk.com/answers/90569/event-count-per-user-per-hour.html
sourcetype=your_sourcetype earliest=-48h latest=-24h | bucket _time span=1h | stats count by _time | sort - count
This will count the events per hour between 48 hours ago to 24 hours ago... (change this as you see fit or remove earliest and latest)
If you want to average all of those results, you would add the stats avg(count)
at the end of the search:
sourcetype=your_sourcetype earliest=-48h latest=-24h | bucket _time span=1h | stats count by _time | stats avg(count)
This will average out the number of events per hour...
If you have a specific event you are looking for, that would go at the beginning:
sourcetype=your_sourcetype earliest=-48h latest=-24h some_thing_that_I'm_trying_to_match | bucket _time span=1h | stats count by _time | sort - count
sourcetype=your_sourcetype earliest=-48h latest=-24h some_thing_that_I'm_trying_to_match | bucket _time span=1h | stats count by _time | stats avg(count)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi
As per this question http://answers.splunk.com/answers/90569/event-count-per-user-per-hour.html
sourcetype=your_sourcetype earliest=-48h latest=-24h | bucket _time span=1h | stats count by _time | sort - count
This will count the events per hour between 48 hours ago to 24 hours ago... (change this as you see fit or remove earliest and latest)
If you want to average all of those results, you would add the stats avg(count)
at the end of the search:
sourcetype=your_sourcetype earliest=-48h latest=-24h | bucket _time span=1h | stats count by _time | stats avg(count)
This will average out the number of events per hour...
If you have a specific event you are looking for, that would go at the beginning:
sourcetype=your_sourcetype earliest=-48h latest=-24h some_thing_that_I'm_trying_to_match | bucket _time span=1h | stats count by _time | sort - count
sourcetype=your_sourcetype earliest=-48h latest=-24h some_thing_that_I'm_trying_to_match | bucket _time span=1h | stats count by _time | stats avg(count)
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
THANK YOU VERY MUCH !!!
