I have user names in the field ContextUsername in index/ sourcetype index=otcs sourcetype=OtcsSummarytimings. To analyze how users are working with the system, I would need the following two counts:
I know I can use timechart, span=1w and a dc(ContextUsername) but I don't know how to realize the part with once a week or only/more than 52 times a year.
Any help would be much appreciated.
Perhaps this will get you started.
index=otcs sourcetype=OtcsSummarytimings earliest=1y | bucket span=1w _time
| stats count by _time, ContextUsername
| stats avg(count) as weeklyUsage, sum(count) as yearlyUsage by ContextUsername
| eval usage=case(weeklyUsage<=1 OR yearlyUsage<=52, "light", weeklyUsage>1 OR yearlyUsage>52, "normal", 1==1, "other")
| table ContextUsername, usage
View solution in original post
Thank you, this works!