Splunk Search

Count unique users visiting each url per day

Alimantado
New Member

Sorry for newbie question but in a real rush.

I'd like to count the number of unique users per day that are visiting particular page URLs and then display the results as table where there is 1 row per day/date and a columns for each page url showing the number of unique visitors to that URL for the day in question.

I have a guid field in my log that contains a unique user id, the 3 urls i am interested in are then identified in a clienturi field and the log also contains a date field.

So for example the query below

index="xxxxx" (clienturi=/Checkout OR clienturi=/Error OR clienturi=/Confirmation) | stats dc(guid) by clienturi,date

Gives me a table like this:

date clienturi dc(guid)
5 May /Checkout 3
5 May /Error 1
6 May /Confirmation 1
6 May /Checkout 2
6 May /Error 1

But i want something like the below where the number in the columns for each url indicates the number of unique guids (users) that visited the url on the date for the row in question

date /Checkout /Confirmation /Error
5 May 3 1 1
6 May 2 0 1

Ideas anyone ? Thanks.

Tags (5)
0 Karma
1 Solution

aholzer
Motivator

You can use chart with an over clause instead of stats

... | chart dc(guid) over date by clienturi

You may have to flip the clienturi and date to get the right row/column.

Hope this helps

View solution in original post

aholzer
Motivator

You can use chart with an over clause instead of stats

... | chart dc(guid) over date by clienturi

You may have to flip the clienturi and date to get the right row/column.

Hope this helps

Alimantado
New Member

Perfect, thanks v.much

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...