Splunk Search

How can I get a running total of distinct users over time?

patrickw
Explorer

I'm trying to track adoption of a new system using Splunk. I have a chart which shows distinct users per day. I'd like to also add a chart that shows cumulative distinct users.

e.g.:
Day    Users       Cumulative Total
1      A, B, C, D  4
2      A, B        4
3      C, D, E, F  6
4      G           7

I've tried streamstats but can't figure out if there is an option to do this.

Tags (1)
1 Solution

Stephen_Sorkin
Splunk Employee
Splunk Employee

Here's an example of a search that does roughly what you want:

eventtype="download" | bin _time span=1d as day | stats values(clientip) as ips dc(clientip) by day | streamstats dc(ips) as "Cumulative total"

The bin command breaks the time into days, the stats calculates the distinct users and user count per day and the streamstats finds the running distinct count of users.

View solution in original post

numb_lock
New Member

When I've ran this and then "Show Report"...the day is a bunch of numbers like 1312330200 which I don't recognize...how do I add to this to convert the day to something readable on the report?

eventtype="download" | bin _time span=1d as day | stats values(clientip) as ips dc(clientip) by day | streamstats dc(ips) as "Cumulative total"

Thanks,

Bob I.

0 Karma

rmorlen
Splunk Employee
Splunk Employee

Try eventtype="download" | bin _time span=1d as day | stats values(clientip) as ips dc(clientip) by day | streamstats dc(ips) as "Cumulative total" | eval ddd=strftime(day,"%b %d %Y") | table ddd "Cumulative total".

0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

Here's an example of a search that does roughly what you want:

eventtype="download" | bin _time span=1d as day | stats values(clientip) as ips dc(clientip) by day | streamstats dc(ips) as "Cumulative total"

The bin command breaks the time into days, the stats calculates the distinct users and user count per day and the streamstats finds the running distinct count of users.

patrickw
Explorer

Thanks - that worked!

0 Karma

Pete_Bassill
Path Finder

You could use | uniq | stats count in a time constrainted search

0 Karma

patrickw
Explorer

Thanks Pete - can you be more specific about the 'time constrained search' part of the answer? I see how | uniq | gets me part way there, but how do I actually get the running total out of that?

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...