Splunk Search

How to count events based on a user name, not the events

NewGhost
Engager

Hi,

I'm struggling with a simple search.

I have multiple events for the same username. I need to count the number of usernames that appeared in those events. I start with just 1 day when there should be only 1 username. But this search returns the count of 7, because it counts events, not usernames, even though I put the username field in the count command:

index=* policy_name=* | stats count(username)

 

I tried adding dedup before stats, but it didn't do anything. What am I missing, please?

 

Thanks,

Alina

 

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

| stats dc(username)

NewGhost
Engager

That's it.

Thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...