topic How can I create a barchart comparing active unique users vs. total users by month? in Getting Data In

How can I create a barchart comparing active unique users vs. total users by month?

svemurilv — Mon, 25 Sep 2017 16:45:54 GMT

How do I create a comparison bar chart of active unique user vs total user by month on Splunk search head?
Both are coming from separate data sources.

Re: How can I create a barchart comparing active unique users vs. total users by month?

DalJeanis — Mon, 25 Sep 2017 17:08:05 GMT

You need to write something like this...

 your search that gets the active users with _time and user 
   | bin _time as Day span=1d
   | stats count as visits by user Day
   | bin Day as Month span=1mon 
   | stats dc(user) as userCount sum(visits) as visitCount  count(visits) as userDayCount by Month

Now you have one record for each month, with the total unique visitors that month (userCount) and the total number of user-days (userDayCount) and the total number of visits (visitCount). If a particular user visited 50 times across 7 days in a particular month, then he will be counted 1, 7, and 50 times, respectively.

Re: How can I create a barchart comparing active unique users vs. total users by month?

svemurilv — Tue, 29 Sep 2020 15:52:11 GMT

okay thanks for the reply but am asking to create the Active users Vs Total users on splunk.