How can I get a running total of distinct users over time?

[patrickw]

I'm trying to track adoption of a new system using Splunk. I have a chart which shows distinct users per day. I'd like to also add a chart that shows cumulative distinct users.

e.g.:
Day    Users       Cumulative Total
1      A, B, C, D  4
2      A, B        4
3      C, D, E, F  6
4      G           7

I've tried streamstats but can't figure out if there is an option to do this.

[numb_lock]

When I've ran this and then "Show Report"...the day is a bunch of numbers like 1312330200 which I don't recognize...how do I add to this to convert the day to something readable on the report?

eventtype="download" | bin _time span=1d as day | stats values(clientip) as ips dc(clientip) by day | streamstats dc(ips) as "Cumulative total"

Thanks,

Bob I.

[rmorlen]

Try eventtype="download" | bin _time span=1d as day | stats values(clientip) as ips dc(clientip) by day | streamstats dc(ips) as "Cumulative total" | eval ddd=strftime(day,"%b %d %Y") | table ddd "Cumulative total".

[Stephen_Sorkin · Accepted solution]

Here's an example of a search that does roughly what you want:

eventtype="download" | bin _time span=1d as day | stats values(clientip) as ips dc(clientip) by day | streamstats dc(ips) as "Cumulative total"

The bin command breaks the time into days, the stats calculates the distinct users and user count per day and the streamstats finds the running distinct count of users.

[patrickw]

Thanks - that worked!

[Pete_Bassill]

You could use | uniq | stats count in a time constrainted search

[patrickw]

Thanks Pete - can you be more specific about the 'time constrained search' part of the answer? I see how | uniq | gets me part way there, but how do I actually get the running total out of that?