Dashboards & Visualizations

Average page views at a user level for a given page

tmtcollins
Explorer

I have a table:

PageID, UserName, Date, count of hits to that page, 

I would like to find the average daily page hits, per article at a UserID level. (for the top 100 most frequently viewed pages)

So for example,
Person xyz, on average views page x, n number of times per day over the last week.

This is the start of the query...

 ... | bucket span=1d _time| stats count by PageID, UserName , _time | sort - count |head 100

Any help much appreciated.

Labels (1)
Tags (1)
1 Solution

woodcock
Esteemed Legend

Try this:

... | bucket span=1d _time
| stats count BY PageID, UserName , _time
| rename COMMENT AS "Calculate and keep the 100 most popular pages"
| eventstats sum(count) AS grandTotal BY PageID
| sort 0 - grandTotal
| streamstats dc(PageID) AS PageRank
| search PageRank <= 100
| rename COMMENT AS "Find avg daily hits per PageID per UserID"
| stats avg(count) AS DailyPageHits BY PageID UserID

Or, more simply this:

... | bin _time span=1h
| top limit=100 PageID BY UserID _time
| stats avg(count) AS DailyPageHits BY PageID UserID

View solution in original post

0 Karma

woodcock
Esteemed Legend

Try this:

... | bucket span=1d _time
| stats count BY PageID, UserName , _time
| rename COMMENT AS "Calculate and keep the 100 most popular pages"
| eventstats sum(count) AS grandTotal BY PageID
| sort 0 - grandTotal
| streamstats dc(PageID) AS PageRank
| search PageRank <= 100
| rename COMMENT AS "Find avg daily hits per PageID per UserID"
| stats avg(count) AS DailyPageHits BY PageID UserID

Or, more simply this:

... | bin _time span=1h
| top limit=100 PageID BY UserID _time
| stats avg(count) AS DailyPageHits BY PageID UserID
0 Karma

tmtcollins
Explorer

Amazing thank you sir.

Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...