<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: Autodesk - unique users per application in Reporting</title>
    <link>https://community.splunk.com/t5/Reporting/Autodesk-unique-users-per-application/m-p/504953#M8118</link>
    <description>&lt;P&gt;HI,&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I guess that when you use the "| dedup Username" you are removing all duplicate entries of users.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;As an example, if user "John" uses app A and app B, dedup command will return only one of these apps. I think the best approach for the unique users per application is to use the "| stats dc()".&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;You can try something like:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;index="autodesk-licensing"
| lookup autodesklicenses.csv Feature AS product OUTPUT FriendlyName AS "product"
| rename "product" AS "Application", "username" AS "Username", "lichost" AS "Hostname"
| addtotals
| stats dc(Username) as "Total Unique Users" by "Application"&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Thu, 18 Jun 2020 11:57:46 GMT</pubDate>
    <dc:creator>alonsocaio</dc:creator>
    <dc:date>2020-06-18T11:57:46Z</dc:date>
    <item>
      <title>Autodesk - unique users per application</title>
      <link>https://community.splunk.com/t5/Reporting/Autodesk-unique-users-per-application/m-p/504851#M8117</link>
      <description>&lt;P&gt;We ingest the debug logs from our Autodesk license servers into Splunk for license usage reporting/ pool exhaustion alerting, etc. I am trying to create a few reports to measure our unique user counts and maximum usage for our Autodesk licensing. I am getting some inconsistent results where the number of unique users is a lot lower than the max number of users over the same time frame. I feel like it is something wrong with the unique users query as the max users query results are pretty close to what I see in the live data. I am pretty new to Splunk so I suspect I am doing something wrong, but after many hours of trial and error I can not figure out what. The queries are below, I would appreciate any suggestions anyone may have.&lt;/P&gt;&lt;P&gt;Unique users per application query:&lt;/P&gt;&lt;P&gt;index="autodesk-licensing"&lt;BR /&gt;| lookup autodesklicenses.csv Feature AS product OUTPUT FriendlyName AS "product"&lt;BR /&gt;| rename "product" AS "Application", "username" AS "Username", "lichost" AS "Hostname"&lt;BR /&gt;| dedup Username&lt;BR /&gt;| addtotals&lt;BR /&gt;| stats count BY "Application"&lt;BR /&gt;| rename "count" AS "Total Unique Users"&lt;/P&gt;&lt;P&gt;Maximum usage query:&lt;BR /&gt;index="autodesk-licensing" sourcetype="lmutil"&lt;BR /&gt;| lookup autodesklicenses.csv Feature AS product OUTPUT FriendlyName AS "Autodesk License"&lt;BR /&gt;| timechart max(current_license_usage) span=8hours by "Autodesk License"&lt;BR /&gt;| eval date_wday=lower(strftime(_time,"%A"))&lt;BR /&gt;| where NOT (date_wday="saturday" OR date_wday="sunday")&lt;BR /&gt;| fields - date_wday&lt;/P&gt;</description>
      <pubDate>Wed, 17 Jun 2020 19:03:06 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Autodesk-unique-users-per-application/m-p/504851#M8117</guid>
      <dc:creator>jeremyblalock</dc:creator>
      <dc:date>2020-06-17T19:03:06Z</dc:date>
    </item>
    <item>
      <title>Re: Autodesk - unique users per application</title>
      <link>https://community.splunk.com/t5/Reporting/Autodesk-unique-users-per-application/m-p/504953#M8118</link>
      <description>&lt;P&gt;HI,&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I guess that when you use the "| dedup Username" you are removing all duplicate entries of users.&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;As an example, if user "John" uses app A and app B, dedup command will return only one of these apps. I think the best approach for the unique users per application is to use the "| stats dc()".&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;You can try something like:&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;index="autodesk-licensing"
| lookup autodesklicenses.csv Feature AS product OUTPUT FriendlyName AS "product"
| rename "product" AS "Application", "username" AS "Username", "lichost" AS "Hostname"
| addtotals
| stats dc(Username) as "Total Unique Users" by "Application"&lt;/LI-CODE&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Thu, 18 Jun 2020 11:57:46 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Reporting/Autodesk-unique-users-per-application/m-p/504953#M8118</guid>
      <dc:creator>alonsocaio</dc:creator>
      <dc:date>2020-06-18T11:57:46Z</dc:date>
    </item>
  </channel>
</rss>

