I'm trying to calculate Total count and avg(count) of users on a specific file...
I don't think it's the right way to do, any help would be appreciated. Thanks.
index=web sourcetype=web_access refe_domain=sample.com file="checkout.jsp" JSESSIONID!="-" | dedup JSESSIONID |stats dc(trueclientip) as TotalUsers by file | stats avg(TotalUsers)
Try something like this
index=web sourcetype=web_access refe_domain=sample.com file="checkout.jsp" JSESSIONID!="-" | dedup JSESSIONID | bucket span=1d _time |stats dc(trueclientip) as TotalUsers by _time file | eventstats avg(TotalUsers) as AvgUsers by file
You may want to look at the appendpipe command.
index=web sourcetype=web_access refe_domain=sample.com file="checkout.jsp" JSESSIONID!="-" | dedup JSESSIONID |stats dc(trueclientip) as TotalUsers by file | appendpipe [stats avg(TotalUsers)]
http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Appendpipe
It's giving me the same values under TotalUsers and avg(TotalUsers), not sure if i'm asking the question in a right way...
I'm looking for TotalUsers/day and also avg users..?
The per day requirement is not in the question.
mcnamara - can you put down a sample event ?