Splunk Search

How to count the unique values of an extracted field by month?

di2esysadmin
Path Finder

We're trying to understand what our growth rate is in Nexus usage. I've been asked to find the unique number of users that log in month over month for the last year or so.

The following search correctly counts the number of unique usernames over the timespan of the search.

index=main host=nexs*prod* "Searching for user" source="/data/sonatype-work/nexus/logs/nexus.log*" source!="/data/sonatype-work/nexus/logs/nexus.log*.tmp" | stats dc(username)

But I've been unsuccessful in getting the results for number of unique usernames for Jan, Feb, Mar, etc. I've tried all kinds of combinations. Can someone help?

THANKS!

0 Karma

woodcock
Esteemed Legend

Like this:

index=main host=nexs*prod* "Searching for user" source="/data/sonatype-work/nexus/logs/nexus.log*" source!="/data/sonatype-work/nexus/logs/nexus.log*.tmp" | eval date_month=strftime(_time, "%b") | chart dc(clerkID) BY host date_month
0 Karma

woodcock
Esteemed Legend

Did this work for you?

0 Karma

di2esysadmin
Path Finder

Sorry. I didn't try every suggestion. I will though. 🙂

0 Karma

woodcock
Esteemed Legend

Once you do, pick the best one and click Answer to close the question.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

Does this help you?

index=main host=nexs*prod* "Searching for user" source="/data/sonatype-work/nexus/logs/nexus.log*" source!="/data/sonatype-work/nexus/logs/nexus.log*.tmp" |timechart span=1mon values(username)

If the result is the expected one, then you can adjust the search to show Month name and also mvexpand to expand the list

    index=main host=nexs*prod* "Searching for user" source="/data/sonatype-work/nexus/logs/nexus.log*" source!="/data/sonatype-work/nexus/logs/nexus.log*.tmp" |timechart span=1mon values(username) as username|mvexpand username|eval month=strftime(_time,"%b")
Happy Splunking!
0 Karma

di2esysadmin
Path Finder

This works, but it provides a list of the unique users and all I need is the count. But if I needed the list, this would do it! 🙂

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

ok that was extended. If you replace values(username) by dc(username) in the first search will give you the count

Happy Splunking!
0 Karma

javiergn
SplunkTrust
SplunkTrust

Is this what you are looking for?

index=main host=nexs*prod* "Searching for user" source="/data/sonatype-work/nexus/logs/nexus.log*" source!="/data/sonatype-work/nexus/logs/nexus.log*.tmp"
| bin _time span=1mon
| stats dc(username) by _time

ppablo
Retired

Hey @di2esysadmin

I see you upvoted this answer, but you didn't accept it. If it did solve your question, please don't forget to resolve the post by clicking "Accept" directly below @javiergn's answer.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...