How to count how many times users came?

[splunkreal]

Data sample :

Date;User
"2016-04-01 09:31:05";"john.doe@gmail.com
"2016-04-01 09:31:06";"jessica.doe@hotmail.com
"2016-04-01 19:31:06";"jessica.doe@hotmail.com

"2016-04-02 11:31:05";"john.doe@gmail.com
"2016-04-02 12:31:06";"jessica.doe@hotmail.com

"2016-04-03 13:31:05";"john.doe@gmail.com
"2016-04-03 14:31:06";"jessica.doe@hotmail.com

"2016-04-04 15:31:05";"john.doe@gmail.com
"2016-04-04 16:31:06";"jessica.doe@hotmail.com
"2016-04-04 18:31:05";"john.doe@gmail.com

The desired output :

Nb users|01/04/2016|02/04/2016|03/04/2016|04/04/2016
1 time |1 |1 |1 |1
2 times |1 |0 |0 |1
3 times |0 |0 |0 |0

[martin_mueller]

Try something like this to produce the desired output:

  base search
| eval Date = strptime(Date, "%Y-%m-%d %H:%M:%S")
| bin span=1d Date
| stats dc(User) by Date
|eval Date = strftime(Date, "%d/%m/%Y")
| chart dc(User) by count Date
| makecontinuous count
| fillnull

[splunkreal]

Thanks, it helped me but I think I found the solution :

| eval date = strptime(date, "%Y-%m-%d %H:%M:%S")
| stats count(user) as count_users by date,user | eval date = strftime(date, "%d/%m/%Y") | appendpipe [stats sum(count_users) as times by date,user] | fields - count_users | table times,date | where (times > 0)

Output :

times date
2 01/04/2016
1 01/04/2016
1 02/04/2016
1 02/04/2016
1 03/04/2016
1 03/04/2016
1 04/04/2016
2 04/04/2016

I need to rotate the table now.