How to generate a search that

[svemurilv]

I am looking for Unique users on my Splunk search head cluster
like :

like compare the users change percentage with previous month.

earliest=-60d@d latest=@d index=_audit  NOT user=splunk-system-user NOT user=admin| timechart span=30d dc(user)

thanks advance.

[DalJeanis · Accepted solution]

Here's one way...

earliest=-6mon@mon latest=@mon index=_audit 
NOT user=splunk-system-user NOT user=admin
| bin _time span=1mon 
| stats dc(user) as UserCount by _time
| streamstats current=f last(UserCount) as PrevCount
| eval PctIncrease= if(isnull(PrevCount),"100%", tostring(floor(100*(UserCount-PrevCount)/PrevCount))."%")