My logs currently capture username and a session id. Keep in mind that 1 session can have multiple hits to different pages or activities.
My definition for users:
new user = users with 1 user session for a given time period
return user = users with more than 1 different user session for a given time period
Is there a way to get new vs return user stats into a pivot table? Is there an easier way to get this detail than the search below?
| dedup user, session
| stats count by user
| eval newuser = if(count =1,1,0)
| eval returnuser = if(count =1,0,1)
|stats sum(newuser) as "New User", sum(returnuser) as "Return User"
Try this
dedup user, session|eventstats count by user|stats sum(eval(count >1)) as old,sum(eval(count == 1)) as new
Try something like this
your base search | stats dc(session) as dc by user | stats count(eval(dc =1)) as "New User" count(eval(dc >1)) as "Return User"
Try this
dedup user, session|eventstats count by user|stats sum(eval(count >1)) as old,sum(eval(count == 1)) as new
both works for me. its a shame they can't fit into a data model. It would've been cool to use in a pivot table. Thanks again.
Hi @spammenot66
Glad you were able to find 2 working answers for your question. Can you please resolve the post by clicking "Accept" directly below the answer that best answered your question (or the one you decided to use)? This will make the question and answers easier to find for other users. Thanks!
Patrick
@ppablo - thanks for the info.