I would like to chart a count of how many distinct days users logged into our system within the past 7 days. When I try to count days, I keep getting 0. Assuming I have seen a total of 200 unique users, output would be something like 100 users seen 7 unique days, 90 users seen 6 unique days, and 10 users seen on 4 unique days.
Not sure if I have the wrong end of the stick, but it's quite easy to get individual day count for events like this:
[host or other filter] AND [event-string] | dedup 1 host date_mday | stats count by host
That's obviously by host but you can change to your username extracted field to do a similar sort of thing...
This seems to work for cisco on my system... how many distinct days users made config changes..
"%SYS-5-CONFIG_I: Configured" | dedup 1 cisco_configuredby,date_mday | stats count by cisco_configuredby
Not sure I can help with the chart though. 🙂
EDIT:
"%SYS-5-CONFIG_I: Configured" | dedup 1 cisco_configuredby,date_mday | stats count AS days by cisco_configuredby | stats count by days
days count
1 17
2 11
3 5
5 2
Not sure if I have the wrong end of the stick, but it's quite easy to get individual day count for events like this:
[host or other filter] AND [event-string] | dedup 1 host date_mday | stats count by host
That's obviously by host but you can change to your username extracted field to do a similar sort of thing...
This seems to work for cisco on my system... how many distinct days users made config changes..
"%SYS-5-CONFIG_I: Configured" | dedup 1 cisco_configuredby,date_mday | stats count by cisco_configuredby
Not sure I can help with the chart though. 🙂
EDIT:
"%SYS-5-CONFIG_I: Configured" | dedup 1 cisco_configuredby,date_mday | stats count AS days by cisco_configuredby | stats count by days
days count
1 17
2 11
3 5
5 2
Thanks! I got it done with
....| stats dc(date_mday) AS UserDaysCount by UserID | chart count(UserDaysCount) by UserDaysCount
which works for less than one month. Not sure why I was getting zero answer at the start, must've had some typo.