How to Calculate Unique Count of Users in Timelion

[yash_mangla (Yash M.)]

Hi Guyz,

I have bunch of logs are coming in kibana. I want to check unique users hit in timelion only.
i have alphanumeric value is coming under 'user' fields and have some segments in another fields then i want to check the trends how many user falls into those segment category ?

how can i check unique hits per user over time on timelion in segmented value ? Please suggest expression regarding timelion for unique hits.

[Stacey_Gammon]

You can view unique counts via cardinality metric, e.g. .es(metric=cardinality:user_id)

[yash_mangla (Yash M.)]

@yash_mangla

on

Hi @Stacey_Gammon,

appreciated your quick reply and many thanks to point out to me in right direction.
I have another question within same context.

i know how can i break the continuous series into segment over normal bar charts or line chart in kibana. but I want to do same in case of timelion as well.

Is there any way in timelion where we can Split those unique counts over a value segment of particular field.

[Stacey_Gammon]

Should be able to do it with split=field:x.

Here is some sample data I am playing with:

So if I'm understanding your desire correctly, you'd like to do something like track the queries but only count them once per unique user? So the count for query cats on the 27th would be 2, not 3, because bob's query would only be counted once.

I think you should be able to use something like this .es(interval=2h, index=search*, timefield=timestamp, split=query.keyword:3, metric=cardinality:user.keyword)

The chart on the left is missing the cardinality metric, while the chart on the right has it added. You can see that on the 27th, the cats query count is only 2.

Does this help?

[yash_mangla (Yash M.)]

Thanks @Stacey_Gammon this is help me a lot. little bit query i also have.

For above query, Is it possible to set some static threshold value over these all segmented values on Time-lion graph ?

[Stacey_Gammon]

@yash_mangla, you can use the .static command:

[yash_mangla (Yash M.)]

Thanks @Stacey_Gammon,

That's what i was looking for. Thanks for sharing....

[yash_mangla (Yash M.)]

Hi @Stacey_Gammon,

if we don't want label for threshold just want line can we do that ? because this line anyway self-explanatory and with label it's not looking good.