Solved: Re: Unique result count timechart

sriniavula66 · ‎03-27-2020

I would like to display unique successful login users time chart report. my query is showing only today's results unique when I used '|dedup email' and wrong numbers showing for previous days.

index=myindex "result"=SUCCESS |timechart span=day count | convert timeformat="%m/%e"

Any thoughts?

Regards
Srini

jpolvino · ‎03-27-2020

If you're looking for the distinct count of logins per day:
| timechart span=1d dc(email) AS Email

View solution in original post

jpolvino · ‎03-27-2020

If you're looking for the distinct count of logins per day:
| timechart span=1d dc(email) AS Email

Unique result count timechart

timechart

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Join the Conversation