Splunk Search

How to search the average and median of the number of events per second for each unique username?

ibondarets
Explorer

Hello!

I need help with a search.
Let's imagine we have Windows logs. These logs contain the field Username.
I want to calculate average and median for number events per second per each unique username.
Strategic goal is to form something like a baseline - "average user generates so much events per hour/day/week". And detect anomalies based on this.

How can I do it?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try something like this. Below should give you events per second for each user.

your base search to get windows logs with field _time and Username | bucket span=1s _time | stats count as eps by _time Username 

Now to calculate avg and median eps per hour/day/week, try like this

above search | bucket span=1h _time | stats avg(eps) as avg_eps median(eps) as median_eps by _time user

Change the span to 1h for hour, 1d for day and 1w for week.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...