Splunk Dev

How to identify uniqe field value from a log files

dilstn
Explorer

there is a logs that as same timestamp , in which i have to identify the unique user id from the logs (i,e) I have to create count of users logged in (unique user entry) count

Tags (1)
0 Karma

eashwar
Communicator

<\yoursearch> | dedup userid | stats count AS "TOTAL Number of Users Logged in"

or

<\yoursearch> | stats count by userid

<\yoursearch> should have the field userid extracted out from the event. you should comment the event so that i can help you in extraction.

happy splunking
yours,
eashwar raghunathan

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Telepathy tells me rex "whatever" | stats dc(user_id)... beyond that, what Ayn said.

0 Karma

Ayn
Legend

Please give us MUCH more details about the logs, what you're trying to do, what you tried but didn't work, etc etc...

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...