I am using the Google Analytics Data Export API to pull some data down into a log file so it can be indexed by splunk. Data is printed out in the following format:
ga:eventCategory=ViewChange | ga:eventAction=Grid ga:totalEvents=6 ga:uniqueEvents=2
ga:eventCategory=SessionEvent | ga:eventAction=UserLogin ga:totalEvents=13 ga:uniqueEvents=9
My search for counting logins is:
source="googleanalytics.txt" "ga:eventCategory=SessionEvent | ga:eventAction=UserLogin" | extract kvdelim="=" | timechart span=1d sum(totalEvents) as "Total Logins", sum(uniqueEvents) as "Unique Logins"
The problem is that the search is taking the first occurrence of ga:totalEvents, regardless of if it is a UserLogin event or not.
Edit: To be more clear, for the above example the timechart displays 6 total, 2 unique logins instead of the expected 13 total, 9 unique. The pipe inside the quotes is read as a search character, but I have removed it just to make sure, am seeing the same result when just searching for "ga:eventAction=UserLogin"
... View more