Search for unique count of users

[bnitesh]

Hi,

I have a Splunk query which lets me view the frequency of visits to pages in my app.

sourcetype="iis" source="*Prod*" cs_uri_filepath="Web/View*" cs_username!="-" | rex Field=cs_uri_filepath "web/view/(?<TabOrFormName>[_A-Za-z]*)" | stats count by TabOrFormName

Now I also want to get numbers for all unique users visiting these urls. Any ideas on how I can do this?

[RicoSuave]

Try this:

sourcetype="iis" source="*Prod*" cs_uri_filepath="Web/View*" cs_username!="-" | rex Field=cs_uri_filepath "web/view/(?<TabOrFormName>[_A-Za-z]*)" | stats count as visits by TabOrFormName | append [ search sourcetype="iis" source="*Prod*" cs_uri_filepath="Web/View*" cs_username!="-" | rex Field=cs_uri_filepath "web/view/(?<TabOrFormName>[_A-Za-z]*)" | stats dc(cs_username) as DistinctCountofUsers by TabOrFormName] | table TabOrFormName visits DistinctCountofUsers

[Ayn · Accepted solution]

... | stats dc(cs_username) by TabOrFormName

[bnitesh]

Works like a charm!

[bnitesh]

cs_username stores the usernames. So I was thinking of using count over cs_username for each row of the final search or something like that.

[Ayn]

Well how would you distinguish unique users based on your log contents?