Hi,
I have a Splunk query which lets me view the frequency of visits to pages in my app.
sourcetype="iis" source="*Prod*" cs_uri_filepath="Web/View*" cs_username!="-" | rex Field=cs_uri_filepath "web/view/(?<TabOrFormName>[_A-Za-z]*)" | stats count by TabOrFormName
Now I also want to get numbers for all unique users visiting these urls. Any ideas on how I can do this?
Try this:
sourcetype="iis" source="*Prod*" cs_uri_filepath="Web/View*" cs_username!="-" | rex Field=cs_uri_filepath "web/view/(?<TabOrFormName>[_A-Za-z]*)" | stats count as visits by TabOrFormName | append [ search sourcetype="iis" source="*Prod*" cs_uri_filepath="Web/View*" cs_username!="-" | rex Field=cs_uri_filepath "web/view/(?<TabOrFormName>[_A-Za-z]*)" | stats dc(cs_username) as DistinctCountofUsers by TabOrFormName] | table TabOrFormName visits DistinctCountofUsers
... | stats dc(cs_username) by TabOrFormName
Works like a charm!
cs_username stores the usernames. So I was thinking of using count over cs_username for each row of the final search or something like that.
Well how would you distinguish unique users based on your log contents?