Splunk Search

count Events per minute but only for same users


Hi Splunkers, 

some examples from our logs.. 

[Time:11:03:01] [Function:upload] [User:aaa]
[Time:11:03:10] [Function:upload] [User:aaa]
[Time:11:03:15] [Function:upload] [User:ccc]
[Time:11:05:30] [Function:upload] [User:aaa]


my search
| bin _time span=1m 
| dedup _time


I want to count the events per 1min. or let's say deduplicate if other events are in 1 minute but only for same users. 
and expect the result like this that user "CCC"  don't filtered. 

[Time:11:03:01] [Function:upload] [User:aaa]
[Time:11:03:30] [Function:upload] [User:ccc]
[Time:11:05:10] [Function:upload] [User:aaa]


But my search filtered also other user's events and the result is like that. 

[Time:11:03:01] [Function:upload] [User:aaa]
[Time:11:05:30] [Function:upload] [User:aaa]

This is only example logs that means users are not only two but over hunderes. 

Can somebody help me how should i search? 



Labels (1)
Tags (3)
0 Karma


The use of bin and dedup together means only one event in each minute will be returned.  That's not going to give the desired results.  Try stats, instead.

your search
| stats count by _time

That will give the number of events for each minute.   To get the number of distinct users for each minute, try

your search
| stats dc(user) as users by _time


If this reply helps you, an upvote would be appreciated.
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!