Dashboards & Visualizations

How to use stats to get sum of unique ids , lists of user and Total count logged.

shalinibisht
Explorer

Hi,

My filter here is , Which shows the list of unique users with the no of times es they have logged into the system/server as success response.

Index=* eventName=* host IN(here is the list of the server) response.status=SUCCESSFUL | stats count by “userId” | sort  - count

The result is attached screen shot.

My requirement is to get the data for total no of distinct users count to, I can fetch it by dc or distinct_count(userId) by how can I get all three data in the same page. The list of users, the sum of users and no of times they logged in as count.list.png

Labels (1)
0 Karma
1 Solution

manjunathmeti
Champion

hi @shalinibisht,

You can use eventstats to get the total number of users.

Index=* eventName=* host IN(here is the list of the server) response.status=SUCCESSFUL | stats count by "userId" | sort  - count | eventstats count(userId) as "Total Number of Users"

Tip: Always use index name(s) instead of * for the index query for better performance.

If this reply helps you, an upvote/like would be appreciated.

View solution in original post

manjunathmeti
Champion

hi @shalinibisht,

You can use eventstats to get the total number of users.

Index=* eventName=* host IN(here is the list of the server) response.status=SUCCESSFUL | stats count by "userId" | sort  - count | eventstats count(userId) as "Total Number of Users"

Tip: Always use index name(s) instead of * for the index query for better performance.

If this reply helps you, an upvote/like would be appreciated.

shalinibisht
Explorer

Hi @manjunathmeti,

Thanks for the resposne.

Eventstats is not working , its throwing an error argument invalid.

Yes I am using index=value(not to mention the name I made it asterik.)

Thanks

Shalini Bisht

 

0 Karma

manjunathmeti
Champion

Try this:

Index=* eventName=* host IN(here is the list of the server) response.status=SUCCESSFUL | stats count by "userId" | sort  - count | eventstats count as "Total Number of Users"
0 Karma

shalinibisht
Explorer

Hi @manjunathmeti 

Thanks that worked!

I could the total count for userid, can the view be chnanged as it will show value multiple timesview.png

0 Karma

manjunathmeti
Champion

you can use stats values but I would not suggest it since you have more than 1000 events.

Index=* eventName=* host IN(here is the list of the server) response.status=SUCCESSFUL | stats count by "userId" | sort  - count | eventstats count as "Total Number of Users" | stats values(*) as *

 

 If these replies help you, likes would be appreciated.

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...