Summarize data per month

[JandrevdM]

Hi, I am trying to get a list off all users that hit our AI rule and see if this increase or decrease over the timespan of 90 days. I want to see the application they use and see the last three months display as columns with a count of amount of users. Example below

Applications	June(Month1)	July(Month2)	August(Month3)
chatGPT	213	233	512

index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access
| table user, app, date_month
```| dedup user, app, date_month```
| stats count by date_month, app
| sort date_month, app 0
| rename count as "Number of Users"
| table date_month, app, "Number of Users"

[ITWhisperer · Accepted solution]

Try this

index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access
| chart count by app date_month

[JandrevdM]

Thanks!

Do you perhaps know how I can summarize count only a user once per month per app.

index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access
| table user, app, date_month
| dedup user,app, date_month
| chart count by app date_month
| sort app 0

This gives me a huge total for august but takes out the events for the other months

[ITWhisperer]

What you have should work, but you could try this instead

index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access
| stats count by user app date_month
| chart count by app date_month

[gcusello]

Hi @JandrevdM ,

what's the issue in your search?

it seems to be correct, even if I'd semplify it:

index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access
| stats count by date_month app
| rename count as "Number of Users"
| table date_month app "Number of Users"

If you have many data to analyze, you could schedure this search, e.g. every night with the events of the day, saving results in a summary index and searching on the summary index.

Ciao.

Giuseppe