Splunk Search

Visualization of the count of users' event counts

brajaram
Communicator

This is probably a simple answer, but I'm pretty new to splunk and my googling hasn't led me to an answer. So I'm trying to write a query that looks like this:

index=<> sourcetype=<> | stats count by uid

A simple query, just get the number of events per UID(User ID). What I want to display, however, is a visualization of the counts per user ID. For example, if I have 5 user IDs that have 5 events, 6 user IDs that have 6 events, and 7 user IDs that have 3 events, I want a graph that displays 3 columns, with the X-axis being the specific values(3 events, 5 events, 6 events), and the Y value being the corresponding counts of users that fit within those counts(7, 5, 6 specifically).

Its probably a very simple solution, but I can't seem to find an answer, so I'm hoping to find it here. Thanks!

0 Karma
1 Solution

somesoni2
Revered Legend

Try this

index=<> sourcetype=<> | stats count as EventCount by uid | stats count as UserCount by EventCount

View solution in original post

somesoni2
Revered Legend

Try this

index=<> sourcetype=<> | stats count as EventCount by uid | stats count as UserCount by EventCount

brajaram
Communicator

Thanks for the quick response! I was trying things in that vein but couldn't get it to work, but your solution worked perfectly.

0 Karma
Get Updates on the Splunk Community!

Security Professional: Sharpen Your Defenses with These .conf25 Sessions

Sooooooooooo, guess what. .conf25 is almost here, and if you're on the Security Learning Path, this is your ...

First Steps with Splunk SOAR

Our first step was to gather a list of the playbooks we wanted and to sort them by priority.  Once this list ...

How To Build a Self-Service Observability Practice with Splunk Observability Cloud

If you’ve read our previous post on self-service observability, you already know what it is and why it ...