Getting Data In

Unique users, above threshhold, within timespan

New Member

Hi all,

Having developed a filter that dials in the events and fields I want, I'd now like to have it display only events in which a unique user exceeds X matching events within Y timeframe.

I've deduced that a combination of top/associate/chart is probably where I need to go, but I can't quite put them together.

Any hints from the common collective?

Thank you!

0 Karma
1 Solution

Splunk Employee
Splunk Employee

How about this:

... earliest=-15m@m latest=now | stats count by user | where count > 20

View solution in original post

0 Karma

New Member

Very help, thank you!

0 Karma

Splunk Employee
Splunk Employee

How about this:

... earliest=-15m@m latest=now | stats count by user | where count > 20

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!