get average actions per hour

[h3xm0nk37]

Hello,

Sorry for may what be an easy question, I have been searching for hours to find a solution to my problem. I have an audit log which I want to get the average number for every "action" performed in an hour since logging began. There are a number of possible actions, for example, search, edit, delete.

An example log looks like this:

timestamp=04-04-2018 19:42:35.072, user=admin, action=search
timestamp=04-04-2018 19:43:35.075, user=admin, action=edit
timestamp=04-04-2018 19:44:35.071, user=admin, action=delete
timestamp=04-04-2018 19:44:37.072, user=admin, action=search

I want the table output to look like this:

Action                           Total_Average_Per_Hour

Search                                      6
Edit                                        3
Delete                                      2

[elliotproebstel]

Assuming your logs are formatted exactly as posted, this should do it for you:

|eval time=strptime(timestamp, "%m-%d-%Y %H") 
| stats count by action, time
| stats avg(count) AS Total_Average_Per_Hour by action

It parses the timestamp with granularity down to the hour, counts the number of events per [action:hour] pairing, then calculates the average per action.

[h3xm0nk37]

Thank you! That seems to be working. 

[elliotproebstel]

Yup! Sure is.