Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Splunk Search
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Search for unique count of users
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
bnitesh
Explorer
10-31-2012
08:17 AM
Hi,
I have a Splunk query which lets me view the frequency of visits to pages in my app.
sourcetype="iis" source="*Prod*" cs_uri_filepath="Web/View*" cs_username!="-" | rex Field=cs_uri_filepath "web/view/(?<TabOrFormName>[_A-Za-z]*)" | stats count by TabOrFormName
Now I also want to get numbers for all unique users visiting these urls. Any ideas on how I can do this?
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ayn
Legend
10-31-2012
09:02 AM
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
RicoSuave
Builder
10-31-2012
09:10 AM
Try this:
sourcetype="iis" source="*Prod*" cs_uri_filepath="Web/View*" cs_username!="-" | rex Field=cs_uri_filepath "web/view/(?<TabOrFormName>[_A-Za-z]*)" | stats count as visits by TabOrFormName | append [ search sourcetype="iis" source="*Prod*" cs_uri_filepath="Web/View*" cs_username!="-" | rex Field=cs_uri_filepath "web/view/(?<TabOrFormName>[_A-Za-z]*)" | stats dc(cs_username) as DistinctCountofUsers by TabOrFormName] | table TabOrFormName visits DistinctCountofUsers
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ayn
Legend
10-31-2012
09:02 AM
... | stats dc(cs_username) by TabOrFormName
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
bnitesh
Explorer
10-31-2012
09:05 AM
Works like a charm!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
bnitesh
Explorer
10-31-2012
08:40 AM
cs_username stores the usernames. So I was thinking of using count over cs_username for each row of the final search or something like that.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ayn
Legend
10-31-2012
08:30 AM
Well how would you distinguish unique users based on your log contents?
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!
Tech Talk Recap | Mastering Threat Hunting
Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...
Observability for AI Applications: Troubleshooting Latency
If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...
Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?
In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...
