Active User count in the application not working

praneethlekkala — Tue, 09 Nov 2021 13:33:33 GMT

I want to know the active user count of an application, the following is the query i created, however its not giving the out put, can someone guide please?

index=application host=Server Name sourcetype="Applicationprod-console-logs" "[AccessLogFilter]"
| rex "^\S+ \S+ \S+ \S+ \S+ (?<USER>\S+) (?<ACTION>\S+) (?<URL>\S+) (?<SIZE>\d+)kb"
| timechart span=15m dc(USER) as Application _User

I am getting the following out put:

_time application_User
1 2021-11-09 00:00:00 0
2 2021-11-09 00:15:00 0
3 2021-11-09 00:30:00 0
4 2021-11-09 00:45:00 0

The Logs if i run the following query shows that there is the User ID in the output:

index=application host=Server Name sourcetype="Applicationprod-console-logs" "[AccessLogFilter]"

Output:

2021-11-09 08:29:12,787 INFO [http-nio-127.0.0.1-8085-exec-101 url: /deploy/viewDeploymentProjectEnvironments.action] [AccessLogFilter] USERID GET application.url.action?id=665059902 4320055kb
host = Server source = location = application-prod-console-logs

Re: Active User count in the application not working

richgalloway — Tue, 09 Nov 2021 20:53:58 GMT

When I tried the regex in regex101.com there were no matches. Removing the leading anchor fixed it.

| rex "\S+ \S+ \S+ \S+ \S+ (?<USER>\S+) (?<ACTION>\S+) (?<URL>\S+) (?<SIZE>\d+)kb"

FWIW, this regex is faster

| rex "url: [^\]]+\] \[\S+] (?<USER>\S+) (?<ACTION>\S+) (?<URL>\S+) (?<SIZE>\d+)kb"

Re: Active User count in the application not working

praneethlekkala — Tue, 09 Nov 2021 22:43:09 GMT

@richgalloway Thanks, It worked!!

topic Re: Active User count in the application not working in Getting Data In

Active User count in the application not working

Re: Active User count in the application not working

Re: Active User count in the application not working