Splunk Search

Count the number of users in more than one time bucket as percent of total users

user93
Communicator

I want to count userid that are in more than one bucket. The goal is to see how many users are returning users. I used first the transaction command, but it did not meet my needs.

base search userId!="" | bucket span=1day _time | stats dc(userId) as UniqueUsers by _time

What I really want is to evaluate the number of users that registered more than bucket span over a given periord of time.

Tags (2)
0 Karma
1 Solution

pkeenan87
Communicator

If you want to see the users that registered more than one bucket span over a period of time we can just reverse the fields in the stats command:

base search userId!="" | bucket span=1day _time | stats dc(_time) as UniqueBuckets by userid | sort - UniqueBuckets

View solution in original post

somesoni2
Revered Legend

Give this a try

base search userId!="" | bucket span=1day _time
| stats dc(_time) as reportedBuckets by userId
| eventstats count as totalUsers
| where reportedBuckets>1
| stats count as userReportingMultiBucket max(totalUsers) as totalUsers
| ...percent calculation goes here...

user93
Communicator

Thank you this worked great!

0 Karma

pkeenan87
Communicator

If you want to see the users that registered more than one bucket span over a period of time we can just reverse the fields in the stats command:

base search userId!="" | bucket span=1day _time | stats dc(_time) as UniqueBuckets by userid | sort - UniqueBuckets

user93
Communicator

Thank you so much for the quick answer.

0 Karma
Get Updates on the Splunk Community!

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...

Routing Data to Different Splunk Indexes in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...