Splunk Search

## How to count how many times users came?

Motivator

Data sample :

Date;User
"2016-04-01 09:31:05";"john.doe@gmail.com
"2016-04-01 09:31:06";"jessica.doe@hotmail.com
"2016-04-01 19:31:06";"jessica.doe@hotmail.com

"2016-04-02 11:31:05";"john.doe@gmail.com
"2016-04-02 12:31:06";"jessica.doe@hotmail.com

"2016-04-03 13:31:05";"john.doe@gmail.com
"2016-04-03 14:31:06";"jessica.doe@hotmail.com

"2016-04-04 15:31:05";"john.doe@gmail.com
"2016-04-04 16:31:06";"jessica.doe@hotmail.com
"2016-04-04 18:31:05";"john.doe@gmail.com

The desired output :

Nb users|01/04/2016|02/04/2016|03/04/2016|04/04/2016
1 time |1 |1 |1 |1
2 times |1 |0 |0 |1
3 times |0 |0 |0 |0

* If this helps, please upvote or accept solution if it solved *
Tags (1)
SplunkTrust

Try something like this to produce the desired output:

``````  base search
| eval Date = strptime(Date, "%Y-%m-%d %H:%M:%S")
| bin span=1d Date
| stats dc(User) by Date
|eval Date = strftime(Date, "%d/%m/%Y")
| chart dc(User) by count Date
| makecontinuous count
| fillnull
``````
Motivator

Thanks, it helped me but I think I found the solution :

| eval date = strptime(date, "%Y-%m-%d %H:%M:%S")
| stats count(user) as count_users by date,user | eval date = strftime(date, "%d/%m/%Y") | appendpipe [stats sum(count_users) as times by date,user] | fields - count_users | table times,date | where (times > 0)

Output :

times date
2 01/04/2016
1 01/04/2016
1 02/04/2016
1 02/04/2016
1 03/04/2016
1 03/04/2016
1 04/04/2016
2 04/04/2016

I need to rotate the table now.

* If this helps, please upvote or accept solution if it solved *
Get Updates on the Splunk Community!

#### Celebrate CX Day with Splunk: Take our interactive quiz, join our LinkedIn Live ...

Today and every day, Splunk celebrates the importance of customer experience throughout our product, ...

#### How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...

#### Out of the Box to Up And Running - Streamlined Observability for Your Cloud ...

Tech Talk Streamlined Observability for Your Cloud Environment Register    Out of the Box to Up And Running ...