Splunk Search

Count unique users visiting each url per day

Alimantado
New Member

Sorry for newbie question but in a real rush.

I'd like to count the number of unique users per day that are visiting particular page URLs and then display the results as table where there is 1 row per day/date and a columns for each page url showing the number of unique visitors to that URL for the day in question.

I have a guid field in my log that contains a unique user id, the 3 urls i am interested in are then identified in a clienturi field and the log also contains a date field.

So for example the query below

index="xxxxx" (clienturi=/Checkout OR clienturi=/Error OR clienturi=/Confirmation) | stats dc(guid) by clienturi,date

Gives me a table like this:

date clienturi dc(guid)
5 May /Checkout 3
5 May /Error 1
6 May /Confirmation 1
6 May /Checkout 2
6 May /Error 1

But i want something like the below where the number in the columns for each url indicates the number of unique guids (users) that visited the url on the date for the row in question

date /Checkout /Confirmation /Error
5 May 3 1 1
6 May 2 0 1

Ideas anyone ? Thanks.

Tags (5)
0 Karma
1 Solution

aholzer
Motivator

You can use chart with an over clause instead of stats

... | chart dc(guid) over date by clienturi

You may have to flip the clienturi and date to get the right row/column.

Hope this helps

View solution in original post

aholzer
Motivator

You can use chart with an over clause instead of stats

... | chart dc(guid) over date by clienturi

You may have to flip the clienturi and date to get the right row/column.

Hope this helps

Alimantado
New Member

Perfect, thanks v.much

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...