Hi, the single searches i would use here and combine externally: to get the dc(user) per day | timechart dc(eval(if(action="purchase", user, null()))) to get every purchasers first day | stats min(eval(if(action="purchase", __time, null()))) by user | eval day=strftime(_time, "%d.%m.%Y") A count per day could be calculated out of the second search and could be added to the first table. Best Heinz ... View more

Hi, thanks for your explanation! Then the " | reverse " function will fit my needs in most of the cases. ... View more

Hi, does it make a difference, how the events are sorted? So, is "last seen" independent of the order of the events and does always mean "the earliest timestamp"? Thanks in advance Heinz ... View more

Hi, what is the difference between " | reverse " and "| sort - _time " ? I would expect the same effect? ... View more

Ich habe gedacht die Zeitstempel werden flachgeklopft, aber die Reihenfolge der Events bleibt bestehen. Entsprechend würde durch "dedup" dann das letzte gewählt. (Falls nicht, wäre das jetzt auch nicht sooo dramatisch. Hauptsache es bleibt erstmal ein einziges pro Tag übrig) In der Lookuptabelle steht der timestamp der "first activity" in sekunden. Das kann ja aber keinen Einfluss auf die Unique_Users haben. Das avg_age wird sich durch "dedup" ändern, da pro User nur noch ein age verwendet wird. ... View more

Hi Martin, im Grunde tut die Suche was ich möchte. Ich habe ein paar Stichproben für einzelne User gemacht. Allerdings scheint mein Ansatz "das letzte Event des Tages pro User" zu behalten" nicht optimal zu sein. Wenn ich "| bucket _time span=1d| dedup user,_time" aus meiner Suche entferne, dürfte sich ja eigentlich nichts an der Anzahl der Unique_Users pro Tag ändern. Aber es kommt zu vereinzelnten (sehr geringen) Veränderungen. ... View more

Hi everybody and thanks for your answers. Unfortunately, I dont think it's possible to adjust your ideas to my search. To avoid misunderstandings, i will post my whole search and try to explain the goals. What i want to achieve is a timechart, which shows the daily active (unique) users and the average age of these users on that day. The age (in days) of user A should be defined in every event as the timespan between his current eventtimestamp and his first activity in the dataset. The first activity (in seconds) of each user is defined in a lookuptable "first_activity.csv". To achieve, that every user is only taken into account once per day to calculate the average age ,i just want to use the age of each users last daily event. So what I've done is this: sourcetype=... | lookup first_activity.csv user OUTPUT firstactivity | eval event_time= eventtime/1000 | eval age=floor((event_time-first_activity)/3600/24)+1 | bucket _time span=1d| dedup user,_time| timechart span=1d dc(user) AS Uniqe_Users,avg(age) AS Avg_Age | eval Avg_Age=round(Avg_Age,0) Best Heinz ... View more

Hi Kristian, I checked it again and obviously I made a mistake yesterday. Everthing seems to work fine, even for weeks (window=7) and 30 days (window=30). Thanks again! Heinz ... View more

Hi, thanks, I tried it out again and now it works for the defined timespan. Is it possible to configure this to run over the whole timespan of the dataset automatically? So that every date is included? Best Heinz ... View more

Hi cramasta, thanks a lot. This was the reason, all events are sortet now 🙂 Do you know if there is a difference between | sort _time and |reverse? The result seems to be the same? ... View more

Hi Ayn, thanks for your post. What i wanted to achieve is, to sort the splunk events ascending. Because i'm using a last() command in my final search, which should always write the previous fieldvalue per user in each event. I justrecognized the missing events, because because of the shorter timechart. That's why i mentioned it first. So it was a bad explanation from my side. ... View more

Hi, I think i have got a similiar problem, which can hopefully be solved with this kind of search. I want to achieve a timechart, where the count per day is about all unique users who have been active on that day and the day before. For Instance: 02.01.2013 - 2500 -> this means, that 2500 users have been active on 01.01.2013 and 02.01.013 I'm not 100 % sure about the effects of the streamstats command, but after reading the posts above, my approach would be: sourcetype=A |bucket _time span=1d| dedup _time,user| sort _time | streamstats current=f window=1 global=f last(_time) as previous_time by user | eval returning_user=_time-previous_time | where returning_user="86400"| timechart span=1d dc(user) Is this a correct adjustment to achieve my needed resultt with this kind of search? Best Regards Heinz ... View more

Hi, another idea came to my mind: set the time to 00:00 per each day dedup user,_time (I would expect that every user will have only one event per day of activity?!) delta _time per user (I would expect, that this calculates the difference of _time: event time of User A - previous event time of User A after that a filter could be set to keep only events where the new calculated field = 86400 timechart dc(user) span=1d Do you think that is possible to get the needed results? Espacially I'm not sure how to realize the step "delta _time per user". Thanks in advance Heinz ... View more

Hello lguinn, unfortunately it still doesn't seem to work properly. Only a few rows in the timechart have a count, which is always 1. ... View more

Hi, is this still possible in the current Splunk Version? Adding this "... earliest=-2w@w1 latest=-1w@w0" doesn't work for me. It tells me "Unknown search command 'earliest'" Thanks in advance Heinz ... View more

Hi, thanks for your answer. When I run your search, there a are only a very few "activeBothDays" with a count of one. I think this is caused, because it is only counted, when the difference of two subsequent events is exactly 86400 sec. I it does not count, if somebody played 01.01.2013 23:00:00 and 02.02.2013 14:00:00. In this case this player should be counted as returned for day 02.02.2013. do you have an idea how to adjust the search? Best Heinz ... View more

Hi there, thanks a lot for your answers. Kristian, I tried out your search and this seems to work fine for the "Last Seven Days". I checked this back for some days in the timechart. I expected, that a change to "window=30" will calculate the dc of users of the last 30 days. But there are differences, when i check back the results of the timechart. Do you have an idea why this happens? Best Heinz ... View more

Hi, thanks for your answer. Using this search will count the total number of actions A,B,C. What I want to achieve in the second part of the seearch in the end, is the number of uniqe users who had such an action. In my understanding one part of the search has to be about stats dc(user) as user_count -> this counts all my users and the second part has to count the unique users for all splunk events who have the value "1" in the added field. I hope this is understandable. Thanks in advance. Heinz ... View more