Splunk Search

Counting averages

jamesklassen
Path Finder

I have data for users running in two modes: Online, and Cached.

I want to get the average number of connections for each type of user over a 1 week period, so that I have a line graph and compare the load on the server for each type of user.

How can I do this? I think I'm way off track...

index=sanindex source="rpc" | timechart span=1h count(client_name)

client_mode is either Online or Cached. client_name is the name of a connecting user.

Thank you

James


Hi, James: Let me add more information about what you're looking for

  • Log Events
   The logs contains
    - client_mode: Classic, Cached, etc...
    - client_name: 100s of different values 

   Each client_name is with either "client_mode=Classic" or "client_mode=Cached" 
  • What to achieve

    1. Count of each client_user every hour in the past one week
    2. Average the count of all the client_user per hour in the past one week
    3. Compare the averaged user's client_mode, Classic and Cached, in order to see one "average" user's mode.
Tags (1)
0 Karma
1 Solution

Masa
Splunk Employee
Splunk Employee

index=sanindex source="rpc" client_mode=Classic OR client_mode=cached earliest=-30d@d latest=@d 
  | bucket _time span=1h 
  | stats count by _time, client_name, client_mode 
  | timechart avg(count) by client_mode

View solution in original post

0 Karma

Masa
Splunk Employee
Splunk Employee

index=sanindex source="rpc" client_mode=Classic OR client_mode=cached earliest=-30d@d latest=@d 
  | bucket _time span=1h 
  | stats count by _time, client_name, client_mode 
  | timechart avg(count) by client_mode

0 Karma

jamesklassen
Path Finder

Thanks gkanpathy, but not quite.

I'd like to compare the average number of connections of each type, per day. So I take the average count of entries per day for client_mode=Cached, and the average count of entires per day where client_mode=Online, and then I can compare the two in a line graph.

Thank you for your help.

0 Karma

gkanapathy
Splunk Employee
Splunk Employee
index=sanindex source="rpc" client_name=* | timechart span=1h count by client_mode
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...