Hi, I am trying to get a list off all users that hit our AI rule and see if this increase or decrease over the timespan of 90 days. I want to see the application they use and see the last three months display as columns with a count of amount of users. Example below
Applications | June(Month1) | July(Month2) | August(Month3) |
chatGPT | 213 | 233 | 512 |
index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access
| table user, app, date_month
```| dedup user, app, date_month```
| stats count by date_month, app
| sort date_month, app 0
| rename count as "Number of Users"
| table date_month, app, "Number of Users"
Try this
index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access
| chart count by app date_month
Try this
index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access
| chart count by app date_month
Thanks!
Do you perhaps know how I can summarize count only a user once per month per app.
index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access
| table user, app, date_month
| dedup user,app, date_month
| chart count by app date_month
| sort app 0
This gives me a huge total for august but takes out the events for the other months
What you have should work, but you could try this instead
index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access
| stats count by user app date_month
| chart count by app date_month
Hi @JandrevdM ,
what's the issue in your search?
it seems to be correct, even if I'd semplify it:
index=db_it_network sourcetype=pan* rule=g_artificial-intelligence-access
| stats count by date_month app
| rename count as "Number of Users"
| table date_month app "Number of Users"
If you have many data to analyze, you could schedure this search, e.g. every night with the events of the day, saving results in a summary index and searching on the summary index.
Ciao.
Giuseppe