Splunk Search

How do modify my search to get an average count of distinct users per day?

Dallastek
Explorer

I have a search where I have total number of users and total number of events per day, but I also need to add a column showing average users per day.

Search:

mysearch | eval full_date = date_wday." ".date_month." ".date_mday | chart count dc(user) AS "Distinct User" by full_date  | rename full_date AS Date, count AS Total  | fieldformat Total=tostring(Total,"commas")  | table Date, "Distinct User", Total

So I currently have a table with Date, Distinct User Total. I just cant seem to get the average to work in this search.

0 Karma

sundareshr
Legend

Try this

 mysearch | eval full_date = date_wday." ".date_month." ".date_mday | chart count dc(user) AS "Distinct User" by full_date  | rename full_date AS Date, count AS Total  | fieldformat Total=tostring(Total,"commas")  | table Date, "Distinct User", Total | eventstats avg("Distinct User") as "Avg User" 
0 Karma

Dallastek
Explorer

That shows the exact same number as the distinct user, perhaps what I am trying to show is the average user count of the total distinct users over time. For instance if I have 1500 distinct users over 7 days, show the average user count for that time

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...