Splunk Search

How can I count my logins by a field?

rebecalopes241
New Member

I have this query and I want to count how many logins were made by id, like if a person logged in 3 times I just want to count once and if there were 15 logins in total I just want to count one per id

basic search 
| fields idLogin 
| stats values(idLogin) as Login, dc(idLogin) as Quantity  
| table Quantity

  but my field idLogin is return null 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your requirement seems self-contradictory - are you wanting the number of times each id was used to login or just a list of the ids used to login?

First case:

| stats count by loginid

Second case:

| dedup loginid
| table loginid

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...