Hi,
We have some events in which two fields appname and UserID are listed. Which shows in each event that which user was trying to hit that application. UserID is a numeric field.
Now my requirement is to get a dashboard which shows in last one hour how many users were accessing the apps . Basically count of users by application. i did like this :
| stats dc(UserId) by appName
I dont get any stat values in the results.
I notice that your description mentions a field called appname
, and your search query uses appName
. Is that just a typo in your post? Splunk is case-sensitive in handling field names, so that discrepancy could be the cause.
If not, can you share any errors you're getting? Or post a sample of the data returned by your search at the stage immediately before the stats call you posted? And last question - in your dashboard, what type of panel are you trying to use to display the data: an events table, a stats table, a single?
I notice that your description mentions a field called appname
, and your search query uses appName
. Is that just a typo in your post? Splunk is case-sensitive in handling field names, so that discrepancy could be the cause.
If not, can you share any errors you're getting? Or post a sample of the data returned by your search at the stage immediately before the stats call you posted? And last question - in your dashboard, what type of panel are you trying to use to display the data: an events table, a stats table, a single?
Not sure how to convert your comment to answer. I want to accept it as the answer.
I converted it to an answer. But as I was doing so, I realized that I didn't really solve your issue, so feel free to post your own answer with an explanation of what you were doing, how you troubleshot it, and what the solution was - and then accept that. If you're up for that, it might help someone in the future. 🙂
Simple fix was to access the field name through nested parsing, i was using appName instead of hdr.appName
Thanks, i messed up with the JSON parsing. These are nested fields and i was trying to access them directly.
Is it perhaps as minor as capitalization? In your text you said it was UserID
, but in your search you used UserId
.
Try:
| stats dc(UserID) by appName