Counting how many days users logged into the server for the last 12 months

[splunktrainingu]

Hello,

I am trying to count how many days out of the last 12 months our users logged into two of our servers.  And in the end I want it to display the days out of the 12 months the users logged in. SO if a user logged in 4 time in one day it should count it as 1 day.  

I have tried the "timechart span=1d count by Account_Name"    this looked promising but timechart groups Account_names in OTHER field that is misleading because there are other accounts in that field.

index=windows source="WinEventLog:Security" EventCode=4624 host IN (Server1, Server2) Logon_Type IN (10, 7)

| eval Account_Name = mvindex(Account_Name,1)
| timechart span=1d count by Account_Name
| untable _time Account_Name count

[yuanliu · Accepted solution]

---

And in the end I want it to display the days out of the 12 months the users logged in. SO if a user logged in 4 time in one day it should count it as 1 day.  

---

If you are aggregating number of days over 12 months, why do you use timechart?  That splits output into individual days the user logged on, therefore the count is the number of times the user logged on each day, i.e., 4 times.

This is the aggregate

index=windows source="WinEventLog:Security" EventCode=4624 host IN (Server1, Server2) Logon_Type IN (10, 7)
| bucket _time span=1d@d
| eval Account_Name = mvindex(Account_Name,1)
| stats dc(_time) as count  by Account_Name

[splunktrainingu]

What does the "1d@d" for span mean?

[yuanliu]

---

What does the "1d@d" for span mean?

---

I'm just speculating that you want to count calendar days, not arbitrary 24-hour periods from the time of your search.  If not, lose that @d. (The "@" notation is called "snap-to".  See Specify a snap to time unit.)

[splunktrainingu]

Thank you for explaining this. I didn't know about this syntax.

[ITWhisperer]

index=windows source="WinEventLog:Security" EventCode=4624 host IN (Server1, Server2) Logon_Type IN (10, 7)

| eval Account_Name = mvindex(Account_Name,1)
| timechart span=1d count by Account_Name useother=f limit=0
| untable _time Account_Name count

[splunktrainingu]

I am sorry this didn't work for me and I tried to get it to work. But I already have a solution.