Embodiments presented herein provide methods, systems and computer program products for determining a count of network users. One method identifies one or more login access requests, from one or more server logs. Each of the one or more login access requests comprises a login cookie, and a user identifier. The method then forms one or more connected components based on the one or more login access requests. Each connected component comprises one or more user identifiers, wherein each of the one or more user identifiers is associated with one or more login cookies. The method finally determines a count of login users based, at least in part, on the user identifiers in the one or more connected components.