Splunk Search

tell how many user visited different sites (transaction with one field same and one field _different_)

a3p
New Member

having a field user_id='1234' and page_id='yellow books' or page_id='green books', i can easily do a search

search | transition user_id

but this also returns users who only visited one of the pages multiple times.
what i need is to track users through different sites and count how many pages they have visited in average. preferable without being limited to a maximum time between events. i.e. over the entire dataset.

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

It looks like this could be done with stats:

your_search | stats dc(page_id) AS distinct_pages c as visits values(page_id) as pages by user_id | where distinct_pages >1 

/K

strive
Influencer

You need total number of unique pages visited by each user OR Average number of visits per user per day.

Can you post some sample log lines.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...