Splunk Search

New users per month

DanielFordWA
Contributor

Is it possible to find the earliest time for all users over all time. Then do a distinct count of users by month using the earliest time as _time, therefore resulting in the distinct count of new users per month?

I don't really want to do the lookup state of the world method. I need to end up with a table : _time "Users" (where Users = new users and _time is by month) I can append this in another search and create some calculated metrics using eval.

0 Karma
1 Solution

David
Splunk Employee
Splunk Employee

I would look at my app, Search Activity, for help with this type of thing. You could easily run

| tstats min(_time) as _time from `SA_Events` groupby user  | timechart count

and leverage the accelerated store.

To do this with raw events, I would go for:

index=_audit user action login attempt info=succeeded user=*  | stats min(_time) as _time by user | timechart count

View solution in original post

David
Splunk Employee
Splunk Employee

I would look at my app, Search Activity, for help with this type of thing. You could easily run

| tstats min(_time) as _time from `SA_Events` groupby user  | timechart count

and leverage the accelerated store.

To do this with raw events, I would go for:

index=_audit user action login attempt info=succeeded user=*  | stats min(_time) as _time by user | timechart count

DanielFordWA
Contributor

Thanks, managed to get it to work wit the following post but will check out the app.

http://answers.splunk.com/answers/229349/can-i-use-an-extracted-date-field-as-my-time-for-m.html

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...