Getting Data In

How can I create a barchart comparing active unique users vs. total users by month?

Path Finder

How do I create a comparison bar chart of active unique user vs total user by month on Splunk search head?
Both are coming from separate data sources.

0 Karma


You need to write something like this...

 your search that gets the active users with _time and user 
   | bin _time as Day span=1d
   | stats count as visits by user Day
   | bin Day as Month span=1mon 
   | stats dc(user) as userCount sum(visits) as visitCount  count(visits) as userDayCount by Month 

Now you have one record for each month, with the total unique visitors that month (userCount) and the total number of user-days (userDayCount) and the total number of visits (visitCount). If a particular user visited 50 times across 7 days in a particular month, then he will be counted 1, 7, and 50 times, respectively.

0 Karma

Path Finder

okay thanks for the reply but am asking to create the Active users Vs Total users on splunk.

index=_audit action="login attempt" "info=succeeded" | dedup user |rename user as "ActiveUsers"
|stats count(ActiveUsers) AS Active
|join ActiveUsers [ |rest /services/authentication/users splunk_server=local
|fields title roles realname|rename title as ALLuserName |stats count(ALLuserName) AS Total ]

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...