https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-running-total-of-distinct-users-over-time/m-p/29793#M6030 <P>When I've ran this and then "Show Report"...the day is a bunch of numbers like 1312330200 which I don't recognize...how do I add to this to convert the day to something readable on the report?</P> <PRE><CODE>eventtype="download" | bin _time span=1d as day | stats values(clientip) as ips dc(clientip) by day | streamstats dc(ips) as "Cumulative total" </CODE></PRE> <P>Thanks,</P> <P>Bob I.</P> Thu, 11 Aug 2011 20:42:51 GMT numb_lock 2011-08-11T20:42:51Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-running-total-of-distinct-users-over-time/m-p/29788#M6025 <P>I'm trying to track adoption of a new system using Splunk. I have a chart which shows distinct users per day. I'd like to also add a chart that shows <EM>cumulative</EM> distinct users.</P> <PRE><CODE>e.g.: Day Users Cumulative Total 1 A, B, C, D 4 2 A, B 4 3 C, D, E, F 6 4 G 7 </CODE></PRE> <P>I've tried streamstats but can't figure out if there is an option to do this.</P> Fri, 13 Aug 2010 20:24:48 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-running-total-of-distinct-users-over-time/m-p/29788#M6025 patrickw 2010-08-13T20:24:48Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-running-total-of-distinct-users-over-time/m-p/29789#M6026 <P>You could use | uniq | stats count in a time constrainted search</P> Fri, 13 Aug 2010 22:26:58 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-running-total-of-distinct-users-over-time/m-p/29789#M6026 Pete_Bassill 2010-08-13T22:26:58Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-running-total-of-distinct-users-over-time/m-p/29790#M6027 <P>Thanks Pete - can you be more specific about the 'time constrained search' part of the answer? I see how | uniq | gets me part way there, but how do I actually get the running total out of that?</P> Sat, 14 Aug 2010 00:23:21 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-running-total-of-distinct-users-over-time/m-p/29790#M6027 patrickw 2010-08-14T00:23:21Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-running-total-of-distinct-users-over-time/m-p/29791#M6028 <P>Here's an example of a search that does roughly what you want:</P> <PRE><CODE>eventtype="download" | bin _time span=1d as day | stats values(clientip) as ips dc(clientip) by day | streamstats dc(ips) as "Cumulative total" </CODE></PRE> <P>The <CODE>bin</CODE> command breaks the time into days, the <CODE>stats</CODE> calculates the distinct users and user count per day and the <CODE>streamstats</CODE> finds the running distinct count of users. </P> Sat, 14 Aug 2010 07:06:32 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-running-total-of-distinct-users-over-time/m-p/29791#M6028 Stephen_Sorkin 2010-08-14T07:06:32Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-running-total-of-distinct-users-over-time/m-p/29792#M6029 <P>Thanks - that worked!</P> Mon, 16 Aug 2010 20:18:45 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-running-total-of-distinct-users-over-time/m-p/29792#M6029 patrickw 2010-08-16T20:18:45Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-running-total-of-distinct-users-over-time/m-p/29793#M6030 <P>When I've ran this and then "Show Report"...the day is a bunch of numbers like 1312330200 which I don't recognize...how do I add to this to convert the day to something readable on the report?</P> <PRE><CODE>eventtype="download" | bin _time span=1d as day | stats values(clientip) as ips dc(clientip) by day | streamstats dc(ips) as "Cumulative total" </CODE></PRE> <P>Thanks,</P> <P>Bob I.</P> Thu, 11 Aug 2011 20:42:51 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-running-total-of-distinct-users-over-time/m-p/29793#M6030 numb_lock 2011-08-11T20:42:51Z https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-running-total-of-distinct-users-over-time/m-p/29794#M6031 <P>Try eventtype="download" | bin _time span=1d as day | stats values(clientip) as ips dc(clientip) by day | streamstats dc(ips) as "Cumulative total" | eval ddd=strftime(day,"%b %d %Y") | table ddd "Cumulative total".</P> Wed, 01 Feb 2012 22:38:21 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-get-a-running-total-of-distinct-users-over-time/m-p/29794#M6031 rmorlen 2012-02-01T22:38:21Z