Splunk Search

Perform stats on full data and deduplicated data

Bulluk
Path Finder

Hi

I need to present a simple couple of counts on some IIS logs. One count will be raw, total hits, the other will be deduplicated by the user to show unique users. The following 2 commands work individually:

"search to return the data" | stats count as TotalHits by cs_uri_stem | table cs_uri_stem, TotalHits 

"search to return the data" | dedup cs_username | stats count as UniqueHits by cs_uri_stem | table cs_uri_stem, UniqueHits 

however I get no results when I bring them togther. I presume this is because the stats command throws columns away but I'm not sure how to overcome it.

"search to return the data" | stats count as TotalHits by cs_uri_stem | dedup cs_username | stats count as UniqueHits by cs_uri_stem | table cs_uri_stem, TotalHits , UniqueHits 

Thanks in advance

Tags (2)
0 Karma
1 Solution

Ayn
Legend

If all you want from the second search is to get a distinct usercount, just use distinct_count or dc which is the short form:

... | stats count as TotalHits,dc(cs_username) as UniqueHits by cs_uri_stem | table cs_uri_stem TotalHits UniqueHits

View solution in original post

0 Karma

Ayn
Legend

If all you want from the second search is to get a distinct usercount, just use distinct_count or dc which is the short form:

... | stats count as TotalHits,dc(cs_username) as UniqueHits by cs_uri_stem | table cs_uri_stem TotalHits UniqueHits
0 Karma

Bulluk
Path Finder

It's easy when you know how 🙂

Thanks for such a quick response!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...