How do I create a timechart with the average of total events/count of users per hour?

[changux]

Hi all.

I have a sourcetype with a lot of events. I want to prepare a timechart that present the total events per hour divided in the count of users to present the average of events per hour according to the number of users. My user field is user_id.

I tried presenting the events per hour as | timechart count by user_id span=1h and other combinations, but I don't know how can operate the timechart against the total count of users.

Any can please help me?

Regards,

[sideview]

I think it's just

<your search terms>
| timechart span=1h count as events dc(user_id) as users
| eval events_per_user=events/users
| fields - events users

[javiergn · Accepted solution]

Not sure if I understood what you are looking for but give this a go:

yoursearch
| fields _time, user_id
| eventstats dc(user_id) as total_users
| timechart span=1h count, first(total_users) as total_users
| eval count = round(count / total_users, 2)
| fields - total_users

[changux]

This is exactly! Thanks a lot.

[changux]

Hello. Some way to improve to only count the quantity of users with activity in the related hour? I mean, if i have from 8am to 9am only 23 users active (not the total sum of users per day).
Thanks!

[javiergn]

Hi,

As @sideview mentioned below, it should be as simple as:

yoursearch
 | fields _time, user_id
 | timechart span=1h count as events, dc(user_id) as users
 | eval events_per_user=events/users
 | fields - events users