Splunk Search

Count uniqe values over a certain period of time

Norling80
Path Finder

Hi

I´m trying to create a search that basically count the number of unique UserId generated over a certain time in the userlog, the UserId consist of 5 digits for example 12345 or 79365 etc.. need help to finalize it.

The search begins like this...
index=main sourcetype=userlog UserId="*" | ...?

regards
Magnus

Tags (1)
0 Karma
1 Solution

aweitzman
Motivator

| stats dc(UserId) should do the trick for you.

View solution in original post

Norling80
Path Finder

Thanks a lot, that worked.
/Magnus

0 Karma

aweitzman
Motivator

| stats dc(UserId) should do the trick for you.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...