Splunk Search

tell how many user visited different sites (transaction with one field same and one field _different_)

a3p
New Member

having a field user_id='1234' and page_id='yellow books' or page_id='green books', i can easily do a search

search | transition user_id

but this also returns users who only visited one of the pages multiple times.
what i need is to track users through different sites and count how many pages they have visited in average. preferable without being limited to a maximum time between events. i.e. over the entire dataset.

Tags (1)
0 Karma

kristian_kolb
Ultra Champion

It looks like this could be done with stats:

your_search | stats dc(page_id) AS distinct_pages c as visits values(page_id) as pages by user_id | where distinct_pages >1 

/K

strive
Influencer

You need total number of unique pages visited by each user OR Average number of visits per user per day.

Can you post some sample log lines.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...