Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How do modify my search to get an average count of distinct users per day?

$
0
0
I have a search where I have total number of users and total number of events per day, but I also need to add a column showing average users per day. Search: mysearch | eval full_date = date_wday." ".date_month." ".date_mday | chart count dc(user) AS "Distinct User" by full_date | rename full_date AS Date, count AS Total | fieldformat Total=tostring(Total,"commas") | table Date, "Distinct User", Total So I currently have a table with Date, Distinct User Total. I just cant seem to get the average to work in this search.

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>