How can I get a running total of distinct users over time?

Question

I'm trying to track adoption of a new system using Splunk. I have a chart which shows distinct users per day. I'd like to also add a chart that shows cumulative distinct users.

e.g.:
Day    Users       Cumulative Total
1      A, B, C, D  4
2      A, B        4
3      C, D, E, F  6
4      G           7

I've tried streamstats but can't figure out if there is an option to do this.

Accepted Answer

5

Here's an example of a search that does roughly what you want:

eventtype="download" | bin _time span=1d as day | stats values(clientip) as ips dc(clientip) by day | streamstats dc(ips) as "Cumulative total"

The bin command breaks the time into days, the stats calculates the distinct users and user count per day and the streamstats finds the running distinct count of users.

link

answered 14 Aug '10, 00:06

Stephen Sorkin ♦
9.0k●5●10
accept rate: 52%

Thanks - that worked!

(16 Aug '10, 13:18) patrickw

Answer 2

0

You could use | uniq | stats count in a time constrainted search

link

answered 13 Aug '10, 15:26

Pete Bassill
186●6
accept rate: 22%

1

Thanks Pete - can you be more specific about the 'time constrained search' part of the answer? I see how | uniq | gets me part way there, but how do I actually get the running total out of that?

(13 Aug '10, 17:23) patrickw

Answer 3

0

When I've ran this and then "Show Report"...the day is a bunch of numbers like 1312330200 which I don't recognize...how do I add to this to convert the day to something readable on the report?

eventtype="download" | bin _time span=1d as day | stats values(clientip) as ips dc(clientip) by day | streamstats dc(ips) as "Cumulative total"

Thanks,

Bob I.

link

answered 11 Aug '11, 13:42

numb_lock
1
accept rate: 0%

edited 11 Aug '11, 13:52

(01 Feb '12, 14:38) rmorlen

How can I get a running total of distinct users over time?

Follow this question

Splunk Resources

Related questions