Splunk Search

Input on how to perform a search, field extraction and calculation ?

sjringo
Contributor

Here is what I am attempting to do:

I am trying to calculate the distinct count of the 'type' of users that are active.

In my log files all of my users have a user name that follows this pattern:  ABCD.aUserName

I am trying to calculate how many distinct users there are that are active for each 'type' where in the above example ABCD is the type.

First looking for high level approach ideas and want to dig into it myself to see what I can get to work but I just am not able to wrap my noodle around how to even approach it ?

I can extract the 'type' and the 'username' but if I have two extracted fields how do I correlate the two to be able to perform a count of dc(usernames) by type ?

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Is this what you mean?

| stats dc(username) by type

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

When the type field is extracted it becomes part of the event from which it was extracted and, therefore, associated with the user name.  Then it's just a matter of using stats dc(username) by type to get the results.

---
If this reply helps you, Karma would be appreciated.

sjringo
Contributor

I guess I was trying to overcomplicate things.  Its starting to make more sense now working through all of these different scenarios.

 

Thanks for the explination...

ITWhisperer
SplunkTrust
SplunkTrust

Is this what you mean?

| stats dc(username) by type
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...