Splunk Search

get average actions per hour

New Member


Sorry for may what be an easy question, I have been searching for hours to find a solution to my problem. I have an audit log which I want to get the average number for every "action" performed in an hour since logging began. There are a number of possible actions, for example, search, edit, delete.

An example log looks like this:

timestamp=04-04-2018 19:42:35.072, user=admin, action=search
timestamp=04-04-2018 19:43:35.075, user=admin, action=edit
timestamp=04-04-2018 19:44:35.071, user=admin, action=delete
timestamp=04-04-2018 19:44:37.072, user=admin, action=search

I want the table output to look like this:

Action                           Total_Average_Per_Hour

Search                                      6
Edit                                        3
Delete                                      2
0 Karma

Assuming your logs are formatted exactly as posted, this should do it for you:

|eval time=strptime(timestamp, "%m-%d-%Y %H") 
| stats count by action, time
| stats avg(count) AS Total_Average_Per_Hour by action

It parses the timestamp with granularity down to the hour, counts the number of events per [action:hour] pairing, then calculates the average per action.

0 Karma

New Member

Thank you! That seems to be working. Just to confirm the search is getting an overall hourly average?

0 Karma

Yup! Sure is.

0 Karma