How to use stats to get sum of unique ids , lists of user and Total count logged.

[shalinibisht]

Hi,

My filter here is , Which shows the list of unique users with the no of times es they have logged into the system/server as success response.

Index=* eventName=* host IN(here is the list of the server) response.status=SUCCESSFUL | stats count by “userId” | sort  - count

The result is attached screen shot.

My requirement is to get the data for total no of distinct users count to, I can fetch it by dc or distinct_count(userId) by how can I get all three data in the same page. The list of users, the sum of users and no of times they logged in as count.

[manjunathmeti · Accepted solution]

hi @shalinibisht,

You can use eventstats to get the total number of users.

Index=* eventName=* host IN(here is the list of the server) response.status=SUCCESSFUL | stats count by "userId" | sort  - count | eventstats count(userId) as "Total Number of Users"

Tip: Always use index name(s) instead of * for the index query for better performance.

If this reply helps you, an upvote/like would be appreciated.

[shalinibisht]

Hi @manjunathmeti,

Thanks for the resposne.

Eventstats is not working , its throwing an error argument invalid.

Yes I am using index=value(not to mention the name I made it asterik.)

Thanks

Shalini Bisht

[manjunathmeti]

Try this:

Index=* eventName=* host IN(here is the list of the server) response.status=SUCCESSFUL | stats count by "userId" | sort  - count | eventstats count as "Total Number of Users"

[shalinibisht]

Hi @manjunathmeti 

Thanks that worked!

I could the total count for userid, can the view be chnanged as it will show value multiple times

[manjunathmeti]

you can use stats values but I would not suggest it since you have more than 1000 events.

Index=* eventName=* host IN(here is the list of the server) response.status=SUCCESSFUL | stats count by "userId" | sort  - count | eventstats count as "Total Number of Users" | stats values(*) as *

 If these replies help you, likes would be appreciated.