topic Re: How to edit my search to create a table with the distinct count of users by domain? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-table-with-the-distinct-count/m-p/243414#M72443 <P>Yea... that's exactly what I needed. Can't believe I overlooked something so simple, I was waaaay over-thinking it. Thank you.</P> Wed, 20 Jan 2016 20:56:27 GMT DEAD_BEEF 2016-01-20T20:56:27Z How to edit my search to create a table with the distinct count of users by domain? https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-table-with-the-distinct-count/m-p/243412#M72441 <P>I am trying to create a table that shows the number of distinct users that have logged into a machine. I am having problems getting the domain to appear next to the distinct user count.</P> <P><STRONG>Current search&amp; output</STRONG><BR /> <CODE>index=logs event=logon | dc(username) AS UserCount</CODE></P> <PRE><CODE>UserCount 106 </CODE></PRE> <P><STRONG>DESIRED Output</STRONG></P> <PRE><CODE>Domain UserCount GUEST 20 INTERNAL 72 EXTERNAL 4 WIRELESS 10 </CODE></PRE> <P>I tried various permutations of stats count by, table, and sum, but I just can't seem to figure it out.</P> Wed, 20 Jan 2016 20:44:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-table-with-the-distinct-count/m-p/243412#M72441 DEAD_BEEF 2016-01-20T20:44:10Z Re: How to edit my search to create a table with the distinct count of users by domain? https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-table-with-the-distinct-count/m-p/243413#M72442 <P>Does <CODE>index=logs event=logon | stats dc(username) AS UserCount by Domain</CODE> not give you what you want?</P> Wed, 20 Jan 2016 20:49:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-table-with-the-distinct-count/m-p/243413#M72442 s2_splunk 2016-01-20T20:49:41Z Re: How to edit my search to create a table with the distinct count of users by domain? https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-table-with-the-distinct-count/m-p/243414#M72443 <P>Yea... that's exactly what I needed. Can't believe I overlooked something so simple, I was waaaay over-thinking it. Thank you.</P> Wed, 20 Jan 2016 20:56:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-create-a-table-with-the-distinct-count/m-p/243414#M72443 DEAD_BEEF 2016-01-20T20:56:27Z