https://community.splunk.com/t5/Splunk-Search/How-to-get-a-daily-count-of-distinct-users-over-a-large-time/m-p/60449#M180133 <P>The best way would be to use sistats and a summary, or alternatively, use report acceleration. With report acceleration, just set up your search and tell Splunk to accelerate, and that should do it.</P> <P>If you summarize yourself, then on a daily basis (and you can backfill later), you run a;</P> <PRE><CODE>... | sistats dc(user) by x,y,z </CODE></PRE> <P>and store that to a summary. Then to get your counts:</P> <P>index=my_summary_index name=my_summary_job | stats dc(user)</P> <P>(or <CODE>... | stats dc(user) by x,y,z</CODE> or <CODE>... | stats dc(user) by x,y</CODE>).</P> <P>the sistats command will have saved the right data, and the stats command will know how to handle what sistats did. Yes, it is doing slightly clever things under the hood.</P> Mon, 28 Sep 2020 13:30:32 GMT gkanapathy 2020-09-28T13:30:32Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-daily-count-of-distinct-users-over-a-large-time/m-p/60448#M180132 <P>I have a simple "| stats dc()" command to get a cumulative sum of distinct users; however, I don't want to have to run this query from the beginning of time every day it runs for performance reasons.</P> <P>These couple routes came to mind, but don't seem best...</P> <OL> <LI>Summary indexes can write out the distinct users per day, but seems like couldn't compute distinct over the whole set of days.</LI> <LI>Write the distinct values to lookup and only adding the new values each day -- a kinda hacky incremental approach.</LI> </OL> <P>Any ideas on the optimal solution?</P> Wed, 13 Mar 2013 17:23:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-daily-count-of-distinct-users-over-a-large-time/m-p/60448#M180132 e_sherlock 2013-03-13T17:23:52Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-daily-count-of-distinct-users-over-a-large-time/m-p/60449#M180133 <P>The best way would be to use sistats and a summary, or alternatively, use report acceleration. With report acceleration, just set up your search and tell Splunk to accelerate, and that should do it.</P> <P>If you summarize yourself, then on a daily basis (and you can backfill later), you run a;</P> <PRE><CODE>... | sistats dc(user) by x,y,z </CODE></PRE> <P>and store that to a summary. Then to get your counts:</P> <P>index=my_summary_index name=my_summary_job | stats dc(user)</P> <P>(or <CODE>... | stats dc(user) by x,y,z</CODE> or <CODE>... | stats dc(user) by x,y</CODE>).</P> <P>the sistats command will have saved the right data, and the stats command will know how to handle what sistats did. Yes, it is doing slightly clever things under the hood.</P> Mon, 28 Sep 2020 13:30:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-daily-count-of-distinct-users-over-a-large-time/m-p/60449#M180133 gkanapathy 2020-09-28T13:30:32Z