Count uniqe values over a certain period of time

[Norling80]

Hi

I´m trying to create a search that basically count the number of unique UserId generated over a certain time in the userlog, the UserId consist of 5 digits for example 12345 or 79365 etc.. need help to finalize it.

The search begins like this...
index=main sourcetype=userlog UserId="*" | ...?

regards
Magnus

[Norling80]

Thanks a lot, that worked.
/Magnus

[aweitzman · Accepted solution]

| stats dc(UserId) should do the trick for you.