https://community.splunk.com/t5/Splunk-Search/Number-of-distinct-days-an-event-occurs-on-within-the-last-month/m-p/72109#M18025 <P>I would like to chart a count of how many distinct days users logged into our system within the past 7 days. When I try to count days, I keep getting 0. Assuming I have seen a total of 200 unique users, output would be something like 100 users seen 7 unique days, 90 users seen 6 unique days, and 10 users seen on 4 unique days. </P> Wed, 25 Sep 2013 01:26:23 GMT fuzzy_rocks 2013-09-25T01:26:23Z https://community.splunk.com/t5/Splunk-Search/Number-of-distinct-days-an-event-occurs-on-within-the-last-month/m-p/72109#M18025 <P>I would like to chart a count of how many distinct days users logged into our system within the past 7 days. When I try to count days, I keep getting 0. Assuming I have seen a total of 200 unique users, output would be something like 100 users seen 7 unique days, 90 users seen 6 unique days, and 10 users seen on 4 unique days. </P> Wed, 25 Sep 2013 01:26:23 GMT https://community.splunk.com/t5/Splunk-Search/Number-of-distinct-days-an-event-occurs-on-within-the-last-month/m-p/72109#M18025 fuzzy_rocks 2013-09-25T01:26:23Z https://community.splunk.com/t5/Splunk-Search/Number-of-distinct-days-an-event-occurs-on-within-the-last-month/m-p/72110#M18026 <P>Not sure if I have the wrong end of the stick, but it's quite easy to get individual day count for events like this:</P> <P>[host or other filter] AND [event-string] | dedup 1 host date_mday | stats count by host</P> <P>That's obviously by host but you can change to your username extracted field to do a similar sort of thing...</P> <P>This seems to work for cisco on my system... how many distinct days users made config changes..</P> <P>"%SYS-5-CONFIG_I: Configured" | dedup 1 cisco_configuredby,date_mday | stats count by cisco_configuredby</P> <P>Not sure I can help with the chart though. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>EDIT: </P> <P>"%SYS-5-CONFIG_I: Configured" | dedup 1 cisco_configuredby,date_mday | stats count AS days by cisco_configuredby | stats count by days</P> <P>days count<BR /> 1 17<BR /> 2 11<BR /> 3 5<BR /> 5 2</P> Mon, 28 Sep 2020 14:50:29 GMT https://community.splunk.com/t5/Splunk-Search/Number-of-distinct-days-an-event-occurs-on-within-the-last-month/m-p/72110#M18026 Narj 2020-09-28T14:50:29Z https://community.splunk.com/t5/Splunk-Search/Number-of-distinct-days-an-event-occurs-on-within-the-last-month/m-p/72111#M18027 <P>Thanks! I got it done with </P> <P>....| stats dc(date_mday) AS UserDaysCount by UserID | chart count(UserDaysCount) by UserDaysCount</P> <P>which works for less than one month. Not sure why I was getting zero answer at the start, must've had some typo.</P> Thu, 26 Sep 2013 16:36:22 GMT https://community.splunk.com/t5/Splunk-Search/Number-of-distinct-days-an-event-occurs-on-within-the-last-month/m-p/72111#M18027 fuzzy_rocks 2013-09-26T16:36:22Z