Splunk Search

How can I count my logins by a field?

rebecalopes241
New Member

I have this query and I want to count how many logins were made by id, like if a person logged in 3 times I just want to count once and if there were 15 logins in total I just want to count one per id

basic search 
| fields idLogin 
| stats values(idLogin) as Login, dc(idLogin) as Quantity  
| table Quantity

  but my field idLogin is return null 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Your requirement seems self-contradictory - are you wanting the number of times each id was used to login or just a list of the ids used to login?

First case:

| stats count by loginid

Second case:

| dedup loginid
| table loginid

 

0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...