https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-list-of-unique-users-in-a-search-and-table/m-p/128870#M35006 <P>First, you need to extract usernames into a field, lets say "USER" after which you can achieve the statistics you want</P> <PRE> index=spss " Login succeeded for user: " | rex "(?i)user: (?P&lt;USER&gt;.*)" </PRE> <P>Unique List of users<BR /> <PRE><BR /> index=spss " Login succeeded for user: " earliest=-24h@h | rex "(?i)user: (?P&lt;USER&gt;.*)" | dedup USER | table USER<BR /> </PRE></P> <P>Number of occurrences of each user within 24hrs</P> <PRE> index=spss " Login succeeded for user: " earliest=-24h@h | rex "(?i)user: (?P&lt;USER&gt;.*)" | stats count by USER </PRE> Wed, 17 Sep 2014 19:30:21 GMT pradeepkumarg 2014-09-17T19:30:21Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-list-of-unique-users-in-a-search-and-table/m-p/128869#M35005 <P>This is my first time using splunk and I have 2 questions. First of all, say I have when I enter a certain search (" Login succeeded for user: ") I get the following 4 values.</P> <OL> <LI>Login succeeded for user: a1b2</LI> <LI>Login succeeded for user: c3d4</LI> <LI>Login succeeded for user: e5f6</LI> <LI>Login succeeded for user: a1b2</LI> </OL> <P>Is there a way that I can modify this query so that I can get a list of unique users (e.g. a1b2, c3d4, e5f6)? Essentially, as soon as the log finds one user, I want it to discard any other result that comes back with the same user. I do not have access to the props file and so I don't think that I can modify indexes on a permanent basis.</P> <P>Secondly, is there a way that I can take 2 related queries (index=spss " Login succeeded for user: ") and (index=spss " Login failed for user: ") and get a count of how many times each one has occurred in the timeframe (e.g. 24 hours)? I'd like to be able to put those two numbers next to each other in a graph or table.</P> <P>Thanks in advance! I look forward to using this tool (platform?)</P> <P>I am running splunk 5.0.9</P> Wed, 17 Sep 2014 18:41:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-list-of-unique-users-in-a-search-and-table/m-p/128869#M35005 Splunkster45 2014-09-17T18:41:33Z https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-list-of-unique-users-in-a-search-and-table/m-p/128870#M35006 <P>First, you need to extract usernames into a field, lets say "USER" after which you can achieve the statistics you want</P> <PRE> index=spss " Login succeeded for user: " | rex "(?i)user: (?P&lt;USER&gt;.*)" </PRE> <P>Unique List of users<BR /> <PRE><BR /> index=spss " Login succeeded for user: " earliest=-24h@h | rex "(?i)user: (?P&lt;USER&gt;.*)" | dedup USER | table USER<BR /> </PRE></P> <P>Number of occurrences of each user within 24hrs</P> <PRE> index=spss " Login succeeded for user: " earliest=-24h@h | rex "(?i)user: (?P&lt;USER&gt;.*)" | stats count by USER </PRE> Wed, 17 Sep 2014 19:30:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-extract-a-list-of-unique-users-in-a-search-and-table/m-p/128870#M35006 pradeepkumarg 2014-09-17T19:30:21Z