How to count events based on a user name, not the events

NewGhost — Thu, 17 Feb 2022 14:04:38 GMT

Hi,

I'm struggling with a simple search.

I have multiple events for the same username. I need to count the number of usernames that appeared in those events. I start with just 1 day when there should be only 1 username. But this search returns the count of 7, because it counts events, not usernames, even though I put the username field in the count command:

index=* policy_name=* | stats count(username)

I tried adding dedup before stats, but it didn't do anything. What am I missing, please?

Thanks,

Alina

Re: How to count events based on a user name, not the events

ITWhisperer — Thu, 17 Feb 2022 14:09:54 GMT

Try this

| stats dc(username)

Re: How to count events based on a user name, not the events

NewGhost — Thu, 17 Feb 2022 14:19:39 GMT

That's it.

Thanks

topic Re: How to count events based on a user name, not the events in Splunk Search

How to count events based on a user name, not the events

Re: How to count events based on a user name, not the events

Re: How to count events based on a user name, not the events