Solved: Unique result count timechart

sriniavula66 · ‎03-27-2020

I would like to display unique successful login users time chart report. my query is showing only today's results unique when I used '|dedup email' and wrong numbers showing for previous days.

index=myindex "result"=SUCCESS |timechart span=day count | convert timeformat="%m/%e"

Any thoughts?

Regards
Srini

jpolvino · ‎03-27-2020

If you're looking for the distinct count of logins per day:
| timechart span=1d dc(email) AS Email

View solution in original post

jpolvino · ‎03-27-2020

If you're looking for the distinct count of logins per day:
| timechart span=1d dc(email) AS Email

Unique result count timechart

timechart

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

A Four-Part Event Series: Full Stack Observability For the AI Era

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

Event Series: Level up your SOC: Advancing with Splunk Enterprise Security

Join the Conversation