https://community.splunk.com/t5/Splunk-Search/Perform-stats-on-full-data-and-deduplicated-data/m-p/56587#M13863 <P>Hi</P> <P>I need to present a simple couple of counts on some IIS logs. One count will be raw, total hits, the other will be deduplicated by the user to show unique users. The following 2 commands work individually:</P> <PRE><CODE>"search to return the data" | stats count as TotalHits by cs_uri_stem | table cs_uri_stem, TotalHits "search to return the data" | dedup cs_username | stats count as UniqueHits by cs_uri_stem | table cs_uri_stem, UniqueHits </CODE></PRE> <P>however I get no results when I bring them togther. I presume this is because the stats command throws columns away but I'm not sure how to overcome it. </P> <PRE><CODE>"search to return the data" | stats count as TotalHits by cs_uri_stem | dedup cs_username | stats count as UniqueHits by cs_uri_stem | table cs_uri_stem, TotalHits , UniqueHits </CODE></PRE> <P>Thanks in advance</P> Mon, 21 May 2012 14:50:44 GMT Bulluk 2012-05-21T14:50:44Z https://community.splunk.com/t5/Splunk-Search/Perform-stats-on-full-data-and-deduplicated-data/m-p/56587#M13863 <P>Hi</P> <P>I need to present a simple couple of counts on some IIS logs. One count will be raw, total hits, the other will be deduplicated by the user to show unique users. The following 2 commands work individually:</P> <PRE><CODE>"search to return the data" | stats count as TotalHits by cs_uri_stem | table cs_uri_stem, TotalHits "search to return the data" | dedup cs_username | stats count as UniqueHits by cs_uri_stem | table cs_uri_stem, UniqueHits </CODE></PRE> <P>however I get no results when I bring them togther. I presume this is because the stats command throws columns away but I'm not sure how to overcome it. </P> <PRE><CODE>"search to return the data" | stats count as TotalHits by cs_uri_stem | dedup cs_username | stats count as UniqueHits by cs_uri_stem | table cs_uri_stem, TotalHits , UniqueHits </CODE></PRE> <P>Thanks in advance</P> Mon, 21 May 2012 14:50:44 GMT https://community.splunk.com/t5/Splunk-Search/Perform-stats-on-full-data-and-deduplicated-data/m-p/56587#M13863 Bulluk 2012-05-21T14:50:44Z https://community.splunk.com/t5/Splunk-Search/Perform-stats-on-full-data-and-deduplicated-data/m-p/56588#M13864 <P>If all you want from the second search is to get a distinct usercount, just use <CODE>distinct_count</CODE> or <CODE>dc</CODE> which is the short form:</P> <PRE><CODE>... | stats count as TotalHits,dc(cs_username) as UniqueHits by cs_uri_stem | table cs_uri_stem TotalHits UniqueHits </CODE></PRE> Mon, 21 May 2012 15:01:02 GMT https://community.splunk.com/t5/Splunk-Search/Perform-stats-on-full-data-and-deduplicated-data/m-p/56588#M13864 Ayn 2012-05-21T15:01:02Z https://community.splunk.com/t5/Splunk-Search/Perform-stats-on-full-data-and-deduplicated-data/m-p/56589#M13865 <P>It's easy when you know how <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>Thanks for such a quick response!</P> Mon, 21 May 2012 15:03:41 GMT https://community.splunk.com/t5/Splunk-Search/Perform-stats-on-full-data-and-deduplicated-data/m-p/56589#M13865 Bulluk 2012-05-21T15:03:41Z