topic Splunk Query for Dashboard/Search Query/Alert in Splunk Enterprise

Splunk Query for Dashboard/Search Query/Alert

phanichintha — Thu, 09 Jul 2020 17:18:00 GMT

Hello Splunkers!

Please find sample Log attached, in this UserId available. Based on this log need Splunk query to create dashboard/search query to get output.

1. The number of user logins on a Daily, Weekly or Monthly basis. (need a query for this)

2. The number of internal vs external user login trend. (need a query for this)

3. Peak user login time of the day. (need a query for this)

4. Peak user login day of the week. (need a query for this)

5. Average time spent on the Platform by Users. (need a query for this)

Re: Splunk Query for Dashboard/Search Query/Alert

samneo — Fri, 10 Jul 2020 11:06:23 GMT

first of all to make this easier and not need a REX if you add | table* at the end does it put all those fields you want into individual tables and of so can you provide the header names of the columns they go into?

Re: Splunk Query for Dashboard/Search Query/Alert

phanichintha — Mon, 13 Jul 2020 16:37:21 GMT

Hello,

sourcetype="%forge%" source="/home/amadmin/log/authentication.audit.json" eventName=AM-LOGIN-COMPLETED OR eventName=AM-LOGOUT userId=*

Need a query for this: Average time spent on the Platform by Users?

Re: Splunk Query for Dashboard/Search Query/Alert

phanichintha — Tue, 14 Jul 2020 05:52:17 GMT

anyone please update..

Re: Splunk Query for Dashboard/Search Query/Alert

samneo — Tue, 14 Jul 2020 07:42:29 GMT

Try something like the below

| stats count avg(eventName) by userId

| eventstats avg(eventName) as events by userId

Try one of them to see if it works for you

Re: Splunk Query for Dashboard/Search Query/Alert

phanichintha — Tue, 14 Jul 2020 07:55:04 GMT

Hello Samneo, Thanks for your query,

I tried for the first case, the snap shows like this. but I need Avg time spent on login and logout by user.

Re: Splunk Query for Dashboard/Search Query/Alert

samneo — Tue, 14 Jul 2020 08:11:04 GMT

When you say time spent, do you want to calculate from the time they logged in and then out and then the total to show?

Re: Splunk Query for Dashboard/Search Query/Alert

phanichintha — Tue, 14 Jul 2020 08:13:09 GMT

Yes, exactly which i mean.

Ex: each user spent how much time on work per day.

Re: Splunk Query for Dashboard/Search Query/Alert

phanichintha — Wed, 15 Jul 2020 04:28:13 GMT

Hello Neo/ Anyone,

Can anyone please share your valuable help.

Re: Splunk Query for Dashboard/Search Query/Alert

phanichintha — Thu, 16 Jul 2020 06:53:49 GMT

Hello, can anyone help on priority, well appreciated.

Re: Splunk Query for Dashboard/Search Query/Alert

phanichintha — Fri, 17 Jul 2020 05:19:53 GMT

Hello, no one has answers for my questions I guess.

Re: Splunk Query for Dashboard/Search Query/Alert

sensitive-thug — Fri, 17 Jul 2020 20:37:52 GMT

Hi phanichintha,

This question has been answered and is marked as solved. If you need help with a separate issue, please post a brand new question so your issue can get more visibility.