How do I edit my search to get stats on new users (1 user session) and return users (2+ different user sessions) for a given time period?

[spammenot66]

My logs currently capture username and a session id. Keep in mind that 1 session can have multiple hits to different pages or activities.

My definition for users:
new user = users with 1 user session for a given time period
return user = users with more than 1 different user session for a given time period

Is there a way to get new vs return user stats into a pivot table? Is there an easier way to get this detail than the search below?

| dedup user, session
| stats count by user
| eval newuser = if(count =1,1,0) 
| eval returnuser = if(count =1,0,1) 
|stats sum(newuser) as "New User", sum(returnuser) as "Return User"

[somesoni2]

Try something like this

your base search | stats dc(session) as dc by user | stats count(eval(dc =1)) as "New User" count(eval(dc >1)) as "Return User"

[renjith_nair · Accepted solution]

Try this

dedup user, session|eventstats count by user|stats sum(eval(count >1)) as old,sum(eval(count == 1)) as new

[spammenot66]

both works for me. its a shame they can't fit into a data model. It would've been cool to use in a pivot table. Thanks again.

[ppablo]

Hi @spammenot66

Glad you were able to find 2 working answers for your question. Can you please resolve the post by clicking "Accept" directly below the answer that best answered your question (or the one you decided to use)? This will make the question and answers easier to find for other users. Thanks!

Patrick

[spammenot66]

@ppablo - thanks for the info.