Good morning fellow splunkers,
I'm trying to display the top 20 page views( aka hits) and visits(unique sessions) within the same table / chart. Below is my query and it's not working:
sourcetype=iis |dedup utma as Visits | stats count(Visits) as Visits, count(Page) as Views by Page | sort - count | head 20
utma is a google analytics tag that defines a user session, hence the dedup. Any suggestions would be greatly appreciated!
Thanks!
Try this
sourcetype=iis | eventstats dc(utma) as Visits | stats count as Views, first(Visits ) as Visits by Page | sort - Views | head 20