I'm pretty new to Splunk and have been playing around with it.
index=sse_cae_summary_idx new_sourcetype=sse_altair_log_summary_stype | search FEATURE_NAME="HWHyperMesh*" FEATURE_VERSION="9.0" | eval DurationHour=DURATION/3600 | chart dc(USER_NAME) as "Unique Users" by USER_NAME
The above code simply gives me each unique user that is using version 9 of Hypermesh. The chart has two columns, username and unique users. The unique users column has a 1 in for each of the users . Ideally, I'd rather have a total column that just details the amount of unique users that are in the search. Please could someone help me out? Thank you.
Thanks, but this creates a separate column with a value in each of the rows ..
User_Name Unique Users Total
User1 1 3
User2 1 3
User3 1 3
Is there a way to just have one field with the total value in instead? Thank you.