Splunk Search

Summarize data per month

JandrevdM
Path Finder

Hi, I am trying to get a list off all users that hit our AI rule and see if this increase or decrease over the timespan of 90 days. I want to see the application they use and see the last three months display as columns with a count of amount of users. Example below

ApplicationsJune(Month1)July(Month2)August(Month3)
chatGPT213233512

 

index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access
| table user, app, date_month
```| dedup user, app, date_month```
| stats count by date_month, app
| sort date_month, app 0
| rename count as "Number of Users"
| table date_month, app, "Number of Users"
Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this

index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access
| chart count by app date_month

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try this

index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access
| chart count by app date_month

JandrevdM
Path Finder

Thanks!

Do you perhaps know how I can summarize count only a user once per month per app.

index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access
| table user, app, date_month
| dedup user,app, date_month
| chart count by app date_month
| sort app 0

This gives me a huge total for august but takes out the events for the other months

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What you have should work, but you could try this instead

index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access
| stats count by user app date_month
| chart count by app date_month
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @JandrevdM ,

what's the issue in your search?

it seems to be correct, even if I'd semplify it:

index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access
| stats count by date_month app
| rename count as "Number of Users"
| table date_month app "Number of Users"

If you have many data to analyze, you could schedure this search, e.g. every night with the events of the day, saving results in a summary index and searching on the summary index.

Ciao.

Giuseppe

Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...