Splunk Search

Stats for number of days a user was active in time period

ChuckM
Engager

I am trying to get a table showing the number of days a user was active in the given time period.  I currently have a working search that gives me the number of total logins for each user and one that gives me the number of unique users per day.  I am looking for "unique days per user". 
ie. if Dave logs in 5x Monday, 3x Tuesday , 0x Wednesday, 2x Thursday, & 0x Friday I want to show 3 active days not 10 logins

Labels (3)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Can you share the current query?

---
If this reply helps you, Karma would be appreciated.
0 Karma

ChuckM
Engager

the query is:

index=main host=[hostname] Operation="UserLogon" ApplicationId=[appid] 

If I add:

| timechart span=1d dc(UserId)
I get Unique users per day

OR I can run with:

|  stats count by UserId 


to get total logins per user for the period

I am looking to get "unique days per user"

0 Karma

richgalloway
SplunkTrust
SplunkTrust

See if this helps.

index=main host=[hostname] Operation="UserLogon" ApplicationId=[appid] 
| bin span=1d _time
| stats dc(_time) as numDays by UserId
---
If this reply helps you, Karma would be appreciated.

ChuckM
Engager

That did it, thanks for the assist.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...