Splunk Search

How to get hourly count, average and standard deviation over days?

IvyZhang
New Member

I want to create a table of count metrics based on hour of the day. So average and stdev of distinct UID at 7:00, 8:00, 9:00, etc.
For example, from 7:00-7:59AM, there are 2 users on Nov 1, 5 users on Nov 2, 6 users on Nov 3,....
I want to see the average and stdev number of users at 7:00-7:59 from Nov 1 to Nov 30.

I can't get standard deviation by using this command. How should I do it???
...|stats dc(UID) as DistinctUID by date_hour, date_mday|stats avg(DistinctUID) stdev(DistinctUID) by date_hour

Thanks!!

0 Karma

ppablo
Retired

Hi @IvyZhang

Did @martin_mueller's answer solve your question?

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Try something like this:

base search | timechart span=1h dc(UID) as DistinctUID | eval hour_of_day = strftime(_time, "%H") | eventstats avg(DistinctUID) as hourly_average stdev(DistinctUID) as hourly_stdev by hour_of_day | fields - hour_of_day
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...