count users who access the system only once per week or only 52 times per year

[madingdisk]

Hi,

I have user names in the field ContextUsername in index/ sourcetype index=otcs sourcetype=OtcsSummarytimings. To analyze how users are working with the system, I would need the following two counts:

1. light users = who access the system only once per week or only 52 times per year
2. normal users = who access the system more than once a week or more than 52 times per year

I know I can use timechart, span=1w and a dc(ContextUsername) but I don't know how to realize the part with once a week or only/more than 52 times a year.

Any help would be much appreciated.
Thanks!

[richgalloway · Accepted solution]

Perhaps this will get you started.

index=otcs sourcetype=OtcsSummarytimings earliest=1y | bucket span=1w _time
| stats count by _time, ContextUsername
| stats avg(count) as weeklyUsage, sum(count) as yearlyUsage by ContextUsername
| eval usage=case(weeklyUsage<=1 OR yearlyUsage<=52, "light", weeklyUsage>1 OR yearlyUsage>52, "normal", 1==1, "other")
| table ContextUsername, usage

[madingdisk]

Thank you, this works!