topic Summarize data per month in Splunk Search

Summarize data per month

JandrevdM — Tue, 20 Aug 2024 06:57:23 GMT

Hi, I am trying to get a list off all users that hit our AI rule and see if this increase or decrease over the timespan of 90 days. I want to see the application they use and see the last three months display as columns with a count of amount of users. Example below

Applications	June(Month1)	July(Month2)	August(Month3)
chatGPT	213	233	512

Re: Summarize data per month

gcusello — Tue, 20 Aug 2024 07:06:04 GMT

Hi @JandrevdM ,

what's the issue in your search?

it seems to be correct, even if I'd semplify it:

index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access | stats count by date_month app | rename count as "Number of Users" | table date_month app "Number of Users"

If you have many data to analyze, you could schedure this search, e.g. every night with the events of the day, saving results in a summary index and searching on the summary index.

Ciao.

Giuseppe

Re: Summarize data per month

ITWhisperer — Tue, 20 Aug 2024 07:17:37 GMT

Try this

index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access | chart count by app date_month

Re: Summarize data per month

JandrevdM — Tue, 20 Aug 2024 09:17:17 GMT

Thanks!

Do you perhaps know how I can summarize count only a user once per month per app.

index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access
| table user, app, date_month
| dedup user,app, date_month
| chart count by app date_month
| sort app 0

This gives me a huge total for august but takes out the events for the other months

Re: Summarize data per month

ITWhisperer — Tue, 20 Aug 2024 11:51:14 GMT

What you have should work, but you could try this instead

index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access | stats count by user app date_month | chart count by app date_month