My log contains entries as shown below.
2023-03-03T14:14:12.718, Level=INFO, ProcessName=App-web, Thread=http-nio-80-exec-78, Code=c.m.Config, Message={"clientIp":"192.168.12.24","cost":1,"method":"GET","reqParam":{"userId":["25632"]},"resp":"{\"code\":1,\"data\":{\"list\":[{\"createDate\":1656942857926,\"groupId\":1000023,\"id\":1173,\"lastUpdate\":16569","user":"myemail@hotmail.com"}
I want to know how many users are using the application in last one hour.
Thanks @yuanliu
Below query worked for me.
| eval Message = replace(_raw, ".+,\s *Message=", "")
| spath input=Message
| stats dc(user) as unique_users
First, I think your log probably look like this instead:
2023-03-03T14:14:12.718, Level=INFO, ProcessName=App-web, Thread=http-nio-80-exec-78, Code=c.m.Config, Message={"clientIp":"192.168.12.24","cost":1,"method":"GET","reqParam":{"userId":["25632"]},"resp":"{\"code\":1,\"data\":{\"list\":[{\"createDate\":1656942857926,\"groupId\":1000023,\"id\":1173,\"lastUpdate\":16569\",\"user\":\"myemail@hotmail.com\"}]}}"}
Second, you need to explain which field/node in Message represents a "user" in your question. If I have to speculate, it is either userId in reqParam or data.user in resp; I further speculate that neither field, especially userId, can have multiple values in a single transaction. So, I'll use this field.
| eval Message = replace(_raw, ".+,\s *Message=", "")
| spath input=Message
| stats dc('reqParam.userId{}') as unique_users