I am trying splunk unique visitors from my Akamai Logs. Akamai determine a unique visitor by combining client ip and xforwarded for. Here is my simple search index="akamai-webcdn-afl-app-s" | stats count by event.message.cliIP, event.reqHdr.xFrwdFor which results in event.message.cliIP event.reqHdr.xFrwdFor count 103.246.36.21 192.168.6.122 3 108.171.134.189 1.43.141.112 1 108.171.134.189 139.163.132.183 2 114.119.160.107 10.179.80.58 1 114.119.160.177 10.179.80.112 1 Each line represents a unique visitor How can I get a count of unique visitors each minute as the below does not work and just give 0 results index="akamai-webcdn-afl-app-s" | stats count by event.message.cliIP, event.reqHdr.xFrwdFor | timechart span=1m count(event.message.cliIP) Thank you for your help 🙂 ... View more

I would like to create Cache_Hit, Cache_Miss and Revalidate_Hit based on the below and doisplay them in the pie graph with percentages and count values Cache_ Hit is when the field event.cache.cacheHit=1 and the field event.cache.cacheStatus!=3 Cache_Miss is when the field event.cache.cacheHit=0 and the field event.cache.cacheStatus=3 Ravlidate_Hit is when the field event.cache.cacheHit=1 and the field event.cache.cacheStatus=3 ... View more