topic Re: Unique users, above threshhold, within timespan in Getting Data In

Unique users, above threshhold, within timespan

atlauren — Thu, 02 Jun 2011 17:43:07 GMT

Hi all,

Having developed a filter that dials in the events and fields I want, I'd now like to have it display only events in which a unique user exceeds X matching events within Y timeframe.

I've deduced that a combination of top/associate/chart is probably where I need to go, but I can't quite put them together.

Any hints from the common collective?

Thank you!

Re: Unique users, above threshhold, within timespan

mw — Thu, 02 Jun 2011 18:10:30 GMT

How about this:

... earliest=-15m@m latest=now | stats count by user | where count > 20

Re: Unique users, above threshhold, within timespan

atlauren — Fri, 03 Jun 2011 20:47:22 GMT

Very help, thank you!