Splunk Search

get average actions per hour

h3xm0nk37
New Member

Hello,

Sorry for may what be an easy question, I have been searching for hours to find a solution to my problem. I have an audit log which I want to get the average number for every "action" performed in an hour since logging began. There are a number of possible actions, for example, search, edit, delete.

An example log looks like this:

timestamp=04-04-2018 19:42:35.072, user=admin, action=search
timestamp=04-04-2018 19:43:35.075, user=admin, action=edit
timestamp=04-04-2018 19:44:35.071, user=admin, action=delete
timestamp=04-04-2018 19:44:37.072, user=admin, action=search

I want the table output to look like this:

Action                           Total_Average_Per_Hour

Search                                      6
Edit                                        3
Delete                                      2
0 Karma

elliotproebstel
Champion

Assuming your logs are formatted exactly as posted, this should do it for you:

|eval time=strptime(timestamp, "%m-%d-%Y %H") 
| stats count by action, time
| stats avg(count) AS Total_Average_Per_Hour by action

It parses the timestamp with granularity down to the hour, counts the number of events per [action:hour] pairing, then calculates the average per action.

0 Karma

h3xm0nk37
New Member

Thank you! That seems to be working. 

0 Karma

elliotproebstel
Champion

Yup! Sure is.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...