Splunk Search

How can I count my logins by a field?

rebecalopes241
New Member

I have this query and I want to count how many logins were made by id, like if a person logged in 3 times I just want to count once and if there were 15 logins in total I just want to count one per id

basic search 
| fields idLogin 
| stats values(idLogin) as Login, dc(idLogin) as Quantity  
| table Quantity

  but my field idLogin is return null 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your requirement seems self-contradictory - are you wanting the number of times each id was used to login or just a list of the ids used to login?

First case:

| stats count by loginid

Second case:

| dedup loginid
| table loginid

 

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...