How to count the unique values of an extracted field by month?

[di2esysadmin]

We're trying to understand what our growth rate is in Nexus usage. I've been asked to find the unique number of users that log in month over month for the last year or so.

The following search correctly counts the number of unique usernames over the timespan of the search.

index=main host=nexs*prod* "Searching for user" source="/data/sonatype-work/nexus/logs/nexus.log*" source!="/data/sonatype-work/nexus/logs/nexus.log*.tmp" | stats dc(username)

But I've been unsuccessful in getting the results for number of unique usernames for Jan, Feb, Mar, etc. I've tried all kinds of combinations. Can someone help?

THANKS!

[woodcock]

Like this:

index=main host=nexs*prod* "Searching for user" source="/data/sonatype-work/nexus/logs/nexus.log*" source!="/data/sonatype-work/nexus/logs/nexus.log*.tmp" | eval date_month=strftime(_time, "%b") | chart dc(clerkID) BY host date_month

[woodcock]

Did this work for you?

[di2esysadmin]

Sorry. I didn't try every suggestion. I will though. 🙂

[woodcock]

Once you do, pick the best one and click Answer to close the question.

[renjith_nair]

Does this help you?

index=main host=nexs*prod* "Searching for user" source="/data/sonatype-work/nexus/logs/nexus.log*" source!="/data/sonatype-work/nexus/logs/nexus.log*.tmp" |timechart span=1mon values(username)

If the result is the expected one, then you can adjust the search to show Month name and also mvexpand to expand the list

    index=main host=nexs*prod* "Searching for user" source="/data/sonatype-work/nexus/logs/nexus.log*" source!="/data/sonatype-work/nexus/logs/nexus.log*.tmp" |timechart span=1mon values(username) as username|mvexpand username|eval month=strftime(_time,"%b")

[di2esysadmin]

This works, but it provides a list of the unique users and all I need is the count. But if I needed the list, this would do it! 🙂

[renjith_nair]

ok that was extended. If you replace values(username) by dc(username) in the first search will give you the count

[javiergn]

Is this what you are looking for?

index=main host=nexs*prod* "Searching for user" source="/data/sonatype-work/nexus/logs/nexus.log*" source!="/data/sonatype-work/nexus/logs/nexus.log*.tmp"
| bin _time span=1mon
| stats dc(username) by _time

[ppablo]

Hey @di2esysadmin

I see you upvoted this answer, but you didn't accept it. If it did solve your question, please don't forget to resolve the post by clicking "Accept" directly below @javiergn's answer.