How to get the number of "unique" request with splunk

[ChrisJack]

We are currently looking for a way to find the number of "unique" request for a given event type with splunk. Like the number of user that hit a 404, but i don't care if a user hit it twice or 10 times, I just want the number of user that had that error. Is there anyway to do that with splunk ?

[Ayn · Accepted solution]

Use the stats operator dc (an alias for distinct_count). Let's say you have the fields httpResponseCode and user. To get a count of how many users got an httpResponseCode of 404, regardless of how many times each user got it, you'd do:

httpResponseCode=404 | stats dc(user)

More information on the dc stats function, along with others, is available here: http://docs.splunk.com/Documentation/Splunk/4.2.2/SearchReference/CommonStatsFunctions

[Ayn]

Yes, that should work fine.

[ChrisJack]

Our user is extracted from the request using a extract field.

Example : localhost_access_log : EXTRACT-myUser =
(?i)/users/(?P[^/]+)

Will I be able to go : httpResponseCode=404 | stats dc(myUser)