sum total unique users in time chart with appendcols

[kmccowen]

I need to sum the PMBI users and ADF Users to get total user count. Any suggestions?

index=gateway host=sc58lgwap* ApplicationID=GATWY | timechart span=1d dc(RequestorUserID) as "PMBI_Users" | append [search index=ctap host=sc58* sourcetype=gateway userid="userId: *" | timechart span=1d dc(userid) as "ADF_Users"]

[woodcock]

Like this:

(index=gateway host=sc58lgwap* ApplicationID=GATWY) OR (index=ctap host=sc58* sourcetype=gateway userid="userId: *") | eval CombinedUser=coalesce(RequestorUserID, userid) | timechart span=1d dc(RequestorUserID) AS PMBI_Users dc(userid) AS ADF_Users dc(CombinedUser) AS Combined_Users

Note: YOU MUST NOT add together dc values to get a combined dc; the combined must be recalculated from the raw data.

[somesoni2 · Accepted solution]

Try this

index=gateway host=sc58lgwap* ApplicationID=GATWY | timechart span=1d dc(RequestorUserID) as "PMBI_Users" | append [search index=ctap host=sc58* sourcetype=gateway userid="userId: *" | timechart span=1d dc(userid) as "ADF_Users"] | timechart span=1d values(*) as * | addtotals 

[kmccowen]

Awesome! What if I want to remove duplicate users if they were in both apps? Would I table and then dedup?

[kmccowen]

Meaning if my user id was logged in to both environments in a given day, the total unique users would be 1. Did you already answer this? I'm not finding it.

[somesoni2]

@woodcock's answer will give you 3 fields, PMBI_Users ADF_Users and Combined_Users(includes removal of duplicates)

[kmccowen]

sounds good, thanks Woodcock!

[woodcock]

The wrong answer was Accepted.

[woodcock]

See my answer.