Dashboards & Visualizations

How to generate a graph to show daily unique users?

greekindian
New Member

I would like to generate a graph that shows the daily unique visitors login based on their e-mail address.

If i logged in yesterday and today, my login should show yesterday and today.
Currently I am running the following search and that shows my login only once.

Below is the search string I am using:

   "login *" sourcetype="*prod_logs"  | rex field=_raw "login (?<email>.*)"  | | dedup email | eval month_day=strftime(_time,"%2y/%2m/%2d") | chart count by month_day [Date Range: Month to date]

Any suggestion on how to graph the unique logins for each day and not unique for "Month to date"?

Tags (2)
0 Karma

FrankVl
Ultra Champion

See the answers below for working alternative solutions. Just wanted to point out why yours doesn’t work as intended:
You do a dedup by email, which retains only a single event per user, loosing information on the date. You should have included _time in your dedup command.

christoph_puppe
Engager

Even easier, when you use the _time of the event, then:

"login " sourcetype="*prod_logs" | rex field=_raw "login (?.)"

| timechart dc(email)

0 Karma

chanfoli
Builder

Try using distinct count like this:

 "login *" sourcetype="*prod_logs"  | rex field=_raw "login (?<email>.*)"  | eval month_day=strftime(_time,"%2y/%2m/%2d") | chart dc(email) by month_day
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...