Getting Data In

Unique users, above threshhold, within timespan

atlauren
New Member

Hi all,

Having developed a filter that dials in the events and fields I want, I'd now like to have it display only events in which a unique user exceeds X matching events within Y timeframe.

I've deduced that a combination of top/associate/chart is probably where I need to go, but I can't quite put them together.

Any hints from the common collective?

Thank you!

0 Karma
1 Solution

mw
Splunk Employee
Splunk Employee

How about this:

... earliest=-15m@m latest=now | stats count by user | where count > 20

View solution in original post

0 Karma

atlauren
New Member

Very help, thank you!

0 Karma

mw
Splunk Employee
Splunk Employee

How about this:

... earliest=-15m@m latest=now | stats count by user | where count > 20
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...