I need to sum the PMBI users and ADF Users to get total user count. Any suggestions?
index=gateway host=sc58lgwap* ApplicationID=GATWY | timechart span=1d dc(RequestorUserID) as "PMBI_Users" | append [search index=ctap host=sc58* sourcetype=gateway userid="userId: *" | timechart span=1d dc(userid) as "ADF_Users"]
Try this
index=gateway host=sc58lgwap* ApplicationID=GATWY | timechart span=1d dc(RequestorUserID) as "PMBI_Users" | append [search index=ctap host=sc58* sourcetype=gateway userid="userId: *" | timechart span=1d dc(userid) as "ADF_Users"] | timechart span=1d values(*) as * | addtotals
Like this:
(index=gateway host=sc58lgwap* ApplicationID=GATWY) OR (index=ctap host=sc58* sourcetype=gateway userid="userId: *") | eval CombinedUser=coalesce(RequestorUserID, userid) | timechart span=1d dc(RequestorUserID) AS PMBI_Users dc(userid) AS ADF_Users dc(CombinedUser) AS Combined_Users
Note: YOU MUST NOT add together dc
values to get a combined dc
; the combined must be recalculated from the raw data.
Try this
index=gateway host=sc58lgwap* ApplicationID=GATWY | timechart span=1d dc(RequestorUserID) as "PMBI_Users" | append [search index=ctap host=sc58* sourcetype=gateway userid="userId: *" | timechart span=1d dc(userid) as "ADF_Users"] | timechart span=1d values(*) as * | addtotals
Awesome! What if I want to remove duplicate users if they were in both apps? Would I table and then dedup?
Meaning if my user id was logged in to both environments in a given day, the total unique users would be 1. Did you already answer this? I'm not finding it.
@woodcock's answer will give you 3 fields, PMBI_Users ADF_Users and Combined_Users(includes removal of duplicates)
sounds good, thanks Woodcock!
The wrong answer was Accepted.
See my answer.