Counting unique values by timeslice

Comments

3 comments

  • Avatar
    Kevin Keech

    Hi Marvyn,

    You should be able to use the count_distinct operator for this case. This will give you a list of usersId and count

    Ex.

    * | parse "UserId\":*," as userId 

    | timeslice by 1h

    | count_distinct(userId) by _timeslice

    0
    Comment actions Permalink
  • Avatar
    Marvyn Leroy

    Thanks! I figured the same by re-reading the docs, but couldn't modify/delete my post as it was in the moderation queue.

    0
    Comment actions Permalink
  • Avatar
    Kevin Keech

    No Problem, glad you figured it out. Maybe your question will help others, so we'll go ahead and leave it here :)

    0
    Comment actions Permalink

Please sign in to leave a comment.