Splunk Search

count users who access the system only once per week or only 52 times per year

madingdisk
Explorer

Hi,

I have user names in the field ContextUsername in index/ sourcetype index=otcs sourcetype=OtcsSummarytimings. To analyze how users are working with the system, I would need the following two counts:

  1. light users = who access the system only once per week or only 52 times per year
  2. normal users = who access the system more than once a week or more than 52 times per year

I know I can use timechart, span=1w and a dc(ContextUsername) but I don't know how to realize the part with once a week or only/more than 52 times a year.

Any help would be much appreciated.
Thanks!

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will get you started.

index=otcs sourcetype=OtcsSummarytimings earliest=1y | bucket span=1w _time
| stats count by _time, ContextUsername
| stats avg(count) as weeklyUsage, sum(count) as yearlyUsage by ContextUsername
| eval usage=case(weeklyUsage<=1 OR yearlyUsage<=52, "light", weeklyUsage>1 OR yearlyUsage>52, "normal", 1==1, "other")
| table ContextUsername, usage
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Perhaps this will get you started.

index=otcs sourcetype=OtcsSummarytimings earliest=1y | bucket span=1w _time
| stats count by _time, ContextUsername
| stats avg(count) as weeklyUsage, sum(count) as yearlyUsage by ContextUsername
| eval usage=case(weeklyUsage<=1 OR yearlyUsage<=52, "light", weeklyUsage>1 OR yearlyUsage>52, "normal", 1==1, "other")
| table ContextUsername, usage
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

madingdisk
Explorer

Thank you, this works!

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!