Splunk Search

Daily Average Event Count by Field

dan_growler
Engager

Let's say I have a field called "host" and it can take the following values: host1, host2, host3.

I'm having trouble writing a query which displays the number of hits each host had today and the average number of hits it has had over all time. A hit is defined as the host appearing in the field so if I had an event where host=host1 - that would count as a hit for host1 (essentially a count).

The output would look something like this:

        Hits_Today    Average_Hits_over_all_time
host1        5              10
host2       12               3
host3       23              16

Any advice?

Tags (2)
0 Karma
1 Solution

sideview
SplunkTrust
SplunkTrust

Well this will give you a table that's close to what you're looking for:

<your search> | eval hit_today = if (_time < relative_time(now(), "@d"), 0, 1) | stats sum(hit_today) as Hits_Today count as Total by host

Except that the last column is just the total count over the given timerange, not the average per day.

If you run the search specifically over 'last 7 days', and you divide 'Total' by 7 with another eval command, you'll have the average count for those 7 days.

If you need to calculate that daily average generically you can use the addinfo command to do it.

see this question and answer which deals with similar issues.

http://answers.splunk.com/questions/2712/line-chart-comparing-yesterdays-result-with-todays-result-i...

View solution in original post

0 Karma

sideview
SplunkTrust
SplunkTrust

Well this will give you a table that's close to what you're looking for:

<your search> | eval hit_today = if (_time < relative_time(now(), "@d"), 0, 1) | stats sum(hit_today) as Hits_Today count as Total by host

Except that the last column is just the total count over the given timerange, not the average per day.

If you run the search specifically over 'last 7 days', and you divide 'Total' by 7 with another eval command, you'll have the average count for those 7 days.

If you need to calculate that daily average generically you can use the addinfo command to do it.

see this question and answer which deals with similar issues.

http://answers.splunk.com/questions/2712/line-chart-comparing-yesterdays-result-with-todays-result-i...

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...