topic Re: Search for unique count of users in Splunk Search

Search for unique count of users

bnitesh — Wed, 31 Oct 2012 15:17:20 GMT

Hi,

I have a Splunk query which lets me view the frequency of visits to pages in my app.

sourcetype="iis" source="*Prod*" cs_uri_filepath="Web/View*" cs_username!="-" | rex Field=cs_uri_filepath "web/view/(?<TabOrFormName>[_A-Za-z]*)" | stats count by TabOrFormName

Now I also want to get numbers for all unique users visiting these urls. Any ideas on how I can do this?

Re: Search for unique count of users

Ayn — Wed, 31 Oct 2012 15:30:06 GMT

Well how would you distinguish unique users based on your log contents?

Re: Search for unique count of users

bnitesh — Mon, 28 Sep 2020 12:43:05 GMT

cs_username stores the usernames. So I was thinking of using count over cs_username for each row of the final search or something like that.

Re: Search for unique count of users

Ayn — Wed, 31 Oct 2012 16:02:01 GMT

... | stats dc(cs_username) by TabOrFormName

Re: Search for unique count of users

bnitesh — Wed, 31 Oct 2012 16:05:38 GMT

Works like a charm!

Re: Search for unique count of users

RicoSuave — Wed, 31 Oct 2012 16:10:37 GMT

Try this:

sourcetype="iis" source="*Prod*" cs_uri_filepath="Web/View*" cs_username!="-" | rex Field=cs_uri_filepath "web/view/(?<TabOrFormName>[_A-Za-z]*)" | stats count as visits by TabOrFormName | append [ search sourcetype="iis" source="*Prod*" cs_uri_filepath="Web/View*" cs_username!="-" | rex Field=cs_uri_filepath "web/view/(?<TabOrFormName>[_A-Za-z]*)" | stats dc(cs_username) as DistinctCountofUsers by TabOrFormName] | table TabOrFormName visits DistinctCountofUsers