Save results to avoid recalculation for new users per day or total number of distinct users

[tmtcollins]

I am pretty new to Splunk and this is my first posted question so here goes...

I have an application and I need to identify:

1. Total distinct users (all time)
2. Total distinct users (Week to date)

My query for total distinct users is basic - ns=monocle Action=Search|stats distinct_count(Email)

The problem is that this query takes ages to run as it has to calculate the total every time it is run.

Is there a more efficient way of doing this? For example, a way of saving the previous results to make the next calculation simpler?

Many thanks,

Tim

[somesoni2]

How many distinct users could be there? I believe you can utilize Splunk's summary index feature here to achieve efficiency in your reports (your need to run reports on larger period, ans need rolling report as well). See this for more information: https://docs.splunk.com/Documentation/Splunk/7.2.5/Knowledge/Usesummaryindexing