Splunk Search
Highlighted

Is there a way to limit the number of events included in the search result per user?

Path Finder

I have some data, which includes a user id.

I can count the number of pageviews, and also the number of unique users who have viewed a page with this search

index=beacon BeaconType=pageview  | stats count, dc(INID)

I'd like to count the total number of pageviews, but cap each user to only have 10 views included. Do you know if this is possible?

Thanks

Tags (3)
0 Karma
Highlighted

Re: Is there a way to limit the number of events included in the search result per user?

SplunkTrust
SplunkTrust

Try something like this. This will take only the 10 (if available) events per INID, rest logic is same.

index=beacon BeaconType=pageview | dedup 10 INID | stats count, dc(INID)

View solution in original post

Highlighted

Re: Is there a way to limit the number of events included in the search result per user?

Path Finder

Thanks a lot!

0 Karma