Splunk Search

How to edit my search to create a table with the distinct count of users by domain?

Builder

I am trying to create a table that shows the number of distinct users that have logged into a machine. I am having problems getting the domain to appear next to the distinct user count.

Current search& output
index=logs event=logon | dc(username) AS UserCount

UserCount
106

DESIRED Output

Domain            UserCount
GUEST                 20
INTERNAL              72
EXTERNAL              4
WIRELESS              10

I tried various permutations of stats count by, table, and sum, but I just can't seem to figure it out.

0 Karma
1 Solution

Splunk Employee
Splunk Employee

Does index=logs event=logon | stats dc(username) AS UserCount by Domain not give you what you want?

View solution in original post

Splunk Employee
Splunk Employee

Does index=logs event=logon | stats dc(username) AS UserCount by Domain not give you what you want?

View solution in original post

Builder

Yea... that's exactly what I needed. Can't believe I overlooked something so simple, I was waaaay over-thinking it. Thank you.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!