topic Chart of unique user logins per day in Security

Chart of unique user logins per day

jeck11 — Thu, 23 Jan 2020 16:55:25 GMT

I feel like an idiot because this should be simple. I'm trying to get a basic graph showing unique user logins per day for our Splunk Cloud environment. This search came from the "Utilization Monitor for Splunk" app and I thought it would be as easy as adding "by day" to the stats segment but that didn't work.

index=_audit user!="splunk-system-user" user!="N/A" user=* host=* NOT (action=log* info=fail*) | stats dc(user) as "Splunkers"

If I were the only user to log in and I only work mon-fri then I would expect the chart to be something like 0,1,1,1,1,1,0.

Can someone please point out what I'm missing before I lose the little hair I have left?

Re: Chart of unique user logins per day

Anantha123 — Thu, 23 Jan 2020 17:01:02 GMT

Hi,

Try this

index=_audit user!="splunk-system-user" user!="N/A" user=* host=* NOT (action=log* info=fail*) | chart dc(user) as "Splunkers" by user , date_wday

Thanks
Anantha

Re: Chart of unique user logins per day

jeck11 — Thu, 23 Jan 2020 18:30:56 GMT

That broke it down more granularly than I was looking for. I updated the question with an example chart.

Re: Chart of unique user logins per day

to4kawa — Thu, 23 Jan 2020 19:16:25 GMT

index=_audit user!="splunk-system-user" user!="N/A" user=* host=* NOT (action=log* info=fail*)
| eval date_wday=strftime(_time,"%F")
| chart dc(user) as "Splunkers" by  date_wday,user
| eval date_wday=strftime(strptime(date_wday,"%F"),"%A")

Re: Chart of unique user logins per day

jeck11 — Wed, 30 Sep 2020 03:51:58 GMT

index=_audit user!="splunk-system-user" user!="N/A" user=* host=* NOT (action=log* info=fail*)
| eval date_wday=strftime(_time,"%F")
| chart dc(user) as "Splunkers" by date_wday

Thank you! The strftime is the key for getting the data I needed.