Is it possible ot get a unique user listing with sourcetype="who"?

[splunk4steve]

I am trying to get a list of people who have logged in to our system in the last 24 hours. The unix app runs a script that generates this every 10 minutes or so. This is fine however I only need to see the information once...not the same list of users over and over again.

Is it possible to do a unique search with that sourcetype?

[martin_mueller]

There are several ways of making results unique. You could do a stats/chart/timechart by user, or run them over values(user), or use dedup, maybe more.

[splunk4steve]

Close! I think this might work:

index="os" sourcetype="who" host="*.domain.com" | dedup host

[martin_mueller]

So... this?

some search over 24 hours | table user | dedup

[splunk4steve]

I am basically trying to get a listing of all users who have logged in to a particular server over a period of 24 hours. I don't need to see that 'martin' logged in at 8:00am over and over again...I only need to see it once.

[martin_mueller]

What result are you trying to achieve from what data?

[splunk4steve]

I've tried using dedup. The problem is that the initial time/date stamp that Splunk adds makes it unique. Is there some way to filter that out?