Splunk Search

Calculate time avg time and std deviation between log entries

tradecraft1914
Explorer

I am trying to average calculate the time between web log entries. If an IP on the network visits the same URL multiple times in a given time period we want to calculate the average time between visits. I cant really do a transaction (at least I dont think so) because the events are the same..no begin or end.

I have a search that groups the IP's that visit a URL more than once and also grabs the log entries for each time the URL is visited.

The fields in the output are:

Timestamp, Src_IP, URL, Count

Now for the fun part. Once average time is calculated we want to calculate standard deviation.

Any help would be greatly appreciated!

Tags (1)

gkanapathy
Splunk Employee
Splunk Employee

Use streamstats

   sourcetype=myweblog 
   | streamstats window=1 global=f current=f
       last(Timestamp) as next_ts
     by Src_IP,URL
   | eval tm_to_next=next_ts-Timestamp
   | stats 
       avg(tm_to_next)
       stdev(tm_to_next)
     by Src_IP,URL 
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...