https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194581#M56089 <P>use table move replace <STRONG>timechart</STRONG> by <STRONG>stats</STRONG> add tables address and count<BR /> like this </P> <PRE><CODE> index="badge" | bucket _time span=30d | stats dc(user) by address| table user count | sort - count | head 100 </CODE></PRE> Wed, 25 Mar 2015 13:53:25 GMT Tanefo 2015-03-25T13:53:25Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194574#M56082 <PRE><CODE>index="badge" | bucket _time span=30d | timechart count by _time, address | sort - count | head </CODE></PRE> <P>What I want to do is get a chart that shows each address and the number of unique users per that address:</P> <PRE><CODE> January February March address 1 15 18 17 address 2 51 54 71 </CODE></PRE> <P>Essentially, this will let us see how many unique users are coming into work, and whether or not people are actually present to do their jobs. Any thoughts on this?</P> Wed, 25 Mar 2015 11:51:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194574#M56082 antifreke 2015-03-25T11:51:40Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194575#M56083 <P>hi try this<BR /> index="badge" | bucket _time span=30d | timechart dc(users) by _time, address | sort - count | head 10</P> Wed, 25 Mar 2015 12:32:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194575#M56083 Tanefo 2015-03-25T12:32:45Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194576#M56084 <P>Hi,<BR /> Do you have a field named users?</P> Wed, 25 Mar 2015 12:38:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194576#M56084 NOUMSSI 2015-03-25T12:38:17Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194577#M56085 <P>index="badge" | bucket _time span=30d | timechart dc(nick) by address | sort - count | head 1000</P> <P>It didn't work, so I tried the one above. Right now it's giving me the following:</P> <PRE><CODE> site 1 site 2 site 3 </CODE></PRE> <P>date 1 535<BR /> date 2 677<BR /> date 3 424</P> Wed, 25 Mar 2015 12:52:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194577#M56085 antifreke 2015-03-25T12:52:14Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194578#M56086 <P>I have a field named nick, yes</P> Wed, 25 Mar 2015 13:10:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194578#M56086 antifreke 2015-03-25T13:10:15Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194579#M56087 <P>please antifreke, explain me again your preocupation. </P> Wed, 25 Mar 2015 13:31:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194579#M56087 Tanefo 2015-03-25T13:31:07Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194580#M56088 <P>I'm wanting to pull up unique users per address over a period of time to see how many people are actually coming to work. </P> <P>So far I have index=badge, fields for nick, and address, table address date_month count</P> Wed, 25 Mar 2015 13:49:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194580#M56088 antifreke 2015-03-25T13:49:51Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194581#M56089 <P>use table move replace <STRONG>timechart</STRONG> by <STRONG>stats</STRONG> add tables address and count<BR /> like this </P> <PRE><CODE> index="badge" | bucket _time span=30d | stats dc(user) by address| table user count | sort - count | head 100 </CODE></PRE> Wed, 25 Mar 2015 13:53:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194581#M56089 Tanefo 2015-03-25T13:53:25Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194582#M56090 <P>Alright, what I have now is the following:<BR /> index="acs_na" | timechart span=7d dc(nick) by address<BR /> This gives me the following:</P> <PRE><CODE> address 1 address 2 address 3 address 4 null other address 5,6,7,8 </CODE></PRE> <P>week 1<BR /><BR /> week 2 <BR /> week 3 </P> <P>I want to flip these, and do dates across the table, and have a list of the locations since we have 45 sites. </P> Wed, 25 Mar 2015 15:14:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194582#M56090 antifreke 2015-03-25T15:14:30Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194583#M56091 <P>Hi @antifreke</P> <P>Please be sure than when responding to someone's answer, click on "Add comment" directly below their answer or, if responding to someone's comment, type in the "Add your comment..." box directly below their comment. You've been typing your responses in the "Enter your answer here..." box at the very bottom of the page which, instead, posts a brand new answer each time when it was really meant as a comment. This will help with a clean continuous flow of the conversation. I already converted your "answers" to comments, so just something to keep in mind from here on out. Thanks!</P> Wed, 25 Mar 2015 19:36:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194583#M56091 ppablo 2015-03-25T19:36:18Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194584#M56092 <P>Hi ! try this <CODE>index="badge" address=* |eval month=strftime(_time, "%m")|chart count by month,address|replace 01 with January in month|replace 02 with February in month|replace 03 with Martch in month|replace 04 with April in month|replace ............</CODE></P> <P>here is one example you can use with your <STRONG>_internal</STRONG> index, <STRONG>sourcetype</STRONG> as your address. test it and let me know</P> <PRE><CODE>index=_internal sourcetype=*| eval month=strftime(_time, "%m")|chart count by month,sourcetype|replace 01 with January in month|replace 02 with February in month|replace 03 with Martch in month|replace 04 with April in month </CODE></PRE> Thu, 26 Mar 2015 22:01:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-chart-the-count-of-unique-users-each/m-p/194584#M56092 stephanefotso 2015-03-26T22:01:51Z