Splunk Search

Count unique users visiting each url per day

Alimantado
New Member

Sorry for newbie question but in a real rush.

I'd like to count the number of unique users per day that are visiting particular page URLs and then display the results as table where there is 1 row per day/date and a columns for each page url showing the number of unique visitors to that URL for the day in question.

I have a guid field in my log that contains a unique user id, the 3 urls i am interested in are then identified in a clienturi field and the log also contains a date field.

So for example the query below

index="xxxxx" (clienturi=/Checkout OR clienturi=/Error OR clienturi=/Confirmation) | stats dc(guid) by clienturi,date

Gives me a table like this:

date clienturi dc(guid)
5 May /Checkout 3
5 May /Error 1
6 May /Confirmation 1
6 May /Checkout 2
6 May /Error 1

But i want something like the below where the number in the columns for each url indicates the number of unique guids (users) that visited the url on the date for the row in question

date /Checkout /Confirmation /Error
5 May 3 1 1
6 May 2 0 1

Ideas anyone ? Thanks.

Tags (5)
0 Karma
1 Solution

aholzer
Motivator

You can use chart with an over clause instead of stats

... | chart dc(guid) over date by clienturi

You may have to flip the clienturi and date to get the right row/column.

Hope this helps

View solution in original post

aholzer
Motivator

You can use chart with an over clause instead of stats

... | chart dc(guid) over date by clienturi

You may have to flip the clienturi and date to get the right row/column.

Hope this helps

Alimantado
New Member

Perfect, thanks v.much

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...