topic Consequent days measurement? in Splunk Search

Consequent days measurement?

Yarsa — Sun, 13 May 2012 11:25:36 GMT

Hi, Let's say "user X" visited my site on these dates:
2/3/2012
2/4/2012
2/5/2012
10/5/2012
11/5/2012

How can I count the number of consequent days "user X" visited?
I would like for the output to be

User X - 3 (consequent days)
User X - 2 (consequent days)

I'll appreciate any ideas:)

Re: Consequent days measurement?

lguinn2 — Mon, 14 May 2012 05:24:35 GMT

Try this

yoursearchhere | 
bucket _time span=1d | 
dedup user _time | 
transaction user maxpause=1d |
table user eventcount | sort user

After you have done your search, whatever it is, the commands that follow

group the time by day - ignoring hours, minutes, etc.
eliminate multiple events from the same user on the same day, leaving a max of 1 event per user per day
group the events into transactions based on the user name, with the provision that there cannot be a gap of greater that a day between events in the transaction
for each user, list the number of events

Re: Consequent days measurement?

Yarsa — Mon, 14 May 2012 08:28:09 GMT

Thanks:) it works very good.
I was also wondering if there is a way to define a condition to limit events with 8 hour difference between them when they occur on two consecutive days.

For example when the user visited on
2/3/2012 23:50
2/4/2012 00:15

I don't want to count this case as two consecutive days.

Is it possible or I'm asking too much?
thanks

Re: Consequent days measurement?

lguinn2 — Tue, 15 May 2012 18:51:31 GMT

I couldn't figure out how to do that, but this version will list the date/times for each user along with the count:

Re: Consequent days measurement?

Yarsa — Thu, 17 May 2012 07:42:16 GMT

Ok thanks very much:)