Input on how to perform a search, field extraction and calculation ?

[sjringo]

Here is what I am attempting to do:

I am trying to calculate the distinct count of the 'type' of users that are active.

In my log files all of my users have a user name that follows this pattern:  ABCD.aUserName

I am trying to calculate how many distinct users there are that are active for each 'type' where in the above example ABCD is the type.

First looking for high level approach ideas and want to dig into it myself to see what I can get to work but I just am not able to wrap my noodle around how to even approach it ?

I can extract the 'type' and the 'username' but if I have two extracted fields how do I correlate the two to be able to perform a count of dc(usernames) by type ?

[richgalloway]

When the type field is extracted it becomes part of the event from which it was extracted and, therefore, associated with the user name.  Then it's just a matter of using stats dc(username) by type to get the results.

[sjringo]

I guess I was trying to overcomplicate things.  Its starting to make more sense now working through all of these different scenarios.

Thanks for the explination...

[ITWhisperer · Accepted solution]

Is this what you mean?

| stats dc(username) by type