We are currently looking for a way to find the number of "unique" request for a given event type with splunk. Like the number of user that hit a 404, but i don't care if a user hit it twice or 10 times, I just want the number of user that had that error. Is there anyway to do that with splunk ?
dc (an alias for
distinct_count). Let's say you have the fields
user. To get a count of how many users got an httpResponseCode of 404, regardless of how many times each user got it, you'd do:
httpResponseCode=404 | stats dc(user)
More information on the
dc stats function, along with others, is available here: http://docs.splunk.com/Documentation/Splunk/4.2.2/SearchReference/CommonStatsFunctions
Our user is extracted from the request using a extract field.
Example : localhostaccesslog : EXTRACT-myUser =
Will I be able to go : httpResponseCode=404 | stats dc(myUser)