Splunk Search

Count the number of users in more than one time bucket as percent of total users

user93
Communicator

I want to count userid that are in more than one bucket. The goal is to see how many users are returning users. I used first the transaction command, but it did not meet my needs.

base search userId!="" | bucket span=1day _time | stats dc(userId) as UniqueUsers by _time

What I really want is to evaluate the number of users that registered more than bucket span over a given periord of time.

Tags (2)
0 Karma
1 Solution

pkeenan87
Communicator

If you want to see the users that registered more than one bucket span over a period of time we can just reverse the fields in the stats command:

base search userId!="" | bucket span=1day _time | stats dc(_time) as UniqueBuckets by userid | sort - UniqueBuckets

View solution in original post

somesoni2
Revered Legend

Give this a try

base search userId!="" | bucket span=1day _time
| stats dc(_time) as reportedBuckets by userId
| eventstats count as totalUsers
| where reportedBuckets>1
| stats count as userReportingMultiBucket max(totalUsers) as totalUsers
| ...percent calculation goes here...

user93
Communicator

Thank you this worked great!

0 Karma

pkeenan87
Communicator

If you want to see the users that registered more than one bucket span over a period of time we can just reverse the fields in the stats command:

base search userId!="" | bucket span=1day _time | stats dc(_time) as UniqueBuckets by userid | sort - UniqueBuckets

user93
Communicator

Thank you so much for the quick answer.

0 Karma
Get Updates on the Splunk Community!

Splunk APM & RUM | Upcoming Planned Maintenance

There will be planned maintenance of the streaming infrastructure for Splunk APM and Splunk RUM in the coming ...

Part 2: Diving Deeper With AIOps

Getting the Most Out of Event Correlation and Alert Storm Detection in Splunk IT Service Intelligence   Watch ...

User Groups | Upcoming Events!

If by chance you weren't already aware, the Splunk Community is host to numerous User Groups, organized ...