Hi,
I'm pretty new to Splunk and have been playing around with it.
index=sse_cae_summary_idx new_sourcetype=sse_altair_log_summary_stype
| search FEATURE_NAME="HWHyperMesh*" FEATURE_VERSION="9.0"
| eval DurationHour=DURATION/3600
| chart dc(USER_NAME) as "Unique Users" by USER_NAME
The above code simply gives me each unique user that is using version 9 of Hypermesh. The chart has two columns, username and unique users. The unique users column has a 1 in for each of the users . Ideally, I'd rather have a total column that just details the amount of unique users that are in the search. Please could someone help me out? Thank you.
hi @barrowvian
try to add end of your query with | addtotals
or | addcoltotals
|addcoltotals
hi @barrowvian
try to add end of your query with | addtotals
or | addcoltotals
That worked perfectly, thank you. Was literally just reading about it as you posted.
@barrowvian,
Just add to your search |eventstats sum("Unique Users") as Total
to get a total in each record
Thanks, but this creates a separate column with a value in each of the rows ..
e.g.
User_Name Unique Users Total
User1 1 3
User2 1 3
User3 1 3
Is there a way to just have one field with the total value in instead? Thank you.
@barrowvian,
Ofcourse we can do it. just to be clear, how does your final output should look like?