https://community.splunk.com/t5/Splunk-Search/Compare-count-of-unique-values-over-two-different-time-periods/m-p/207613#M187767 <P>Lots of ways to do this. One method is just using eval (you may need to adjust this based on your field names eg department)</P> <PRE><CODE>&lt;yoursearch&gt; earliest =-90d@d | eval UniqueUsersNinetyDays =if(_time&lt;relative_time(now(),"-30d"),user,NULL) |eval UniqueUsersThirtyDays=if(_time&gt;relative_time(now(),"-30d"),user,NULL)| stats dc(UniqueUsersNinetyDays) as UniqueUsersNinetyDays dc(UniqueUsersThirtyDays) as UniqueUsersThirtyDays by department| eval Ratio=UniqueUsersNinetyDays/UniqueUsersThirtyDays </CODE></PRE> <P>You could also run a couple of subsearches, or use eventstats. As a newbie, I highly recommend you get familiar with stats, chart and eval. The documentation for these commands is great. </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Chart">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Chart</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval</A></P> <P>Also search for those commands on splunk answers - there are lots of real world examples</P> Wed, 23 Dec 2015 18:42:54 GMT jplumsdaine22 2015-12-23T18:42:54Z https://community.splunk.com/t5/Splunk-Search/Compare-count-of-unique-values-over-two-different-time-periods/m-p/207612#M187766 <P>Please forgive my ignorance, I am newbie to Splunk. I am trying to depict a unique count of users over two different time periods and show a ratio between the two. I would like to the following: A=Active users that have logged on within the last 90 days by department, B= Active users that have logged on with the last 30 days by department C: ratio between A and B by department. I have figured how to get A and B as separate queries, but how do I combine them into a single table?</P> Wed, 23 Dec 2015 14:05:55 GMT https://community.splunk.com/t5/Splunk-Search/Compare-count-of-unique-values-over-two-different-time-periods/m-p/207612#M187766 kennyja 2015-12-23T14:05:55Z https://community.splunk.com/t5/Splunk-Search/Compare-count-of-unique-values-over-two-different-time-periods/m-p/207613#M187767 <P>Lots of ways to do this. One method is just using eval (you may need to adjust this based on your field names eg department)</P> <PRE><CODE>&lt;yoursearch&gt; earliest =-90d@d | eval UniqueUsersNinetyDays =if(_time&lt;relative_time(now(),"-30d"),user,NULL) |eval UniqueUsersThirtyDays=if(_time&gt;relative_time(now(),"-30d"),user,NULL)| stats dc(UniqueUsersNinetyDays) as UniqueUsersNinetyDays dc(UniqueUsersThirtyDays) as UniqueUsersThirtyDays by department| eval Ratio=UniqueUsersNinetyDays/UniqueUsersThirtyDays </CODE></PRE> <P>You could also run a couple of subsearches, or use eventstats. As a newbie, I highly recommend you get familiar with stats, chart and eval. The documentation for these commands is great. </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Chart">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Chart</A><BR /> <A href="http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval">http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval</A></P> <P>Also search for those commands on splunk answers - there are lots of real world examples</P> Wed, 23 Dec 2015 18:42:54 GMT https://community.splunk.com/t5/Splunk-Search/Compare-count-of-unique-values-over-two-different-time-periods/m-p/207613#M187767 jplumsdaine22 2015-12-23T18:42:54Z