topic Re: Determine Peak Concurrency Aggregating IIS Logs in Getting Data In

Determine Peak Concurrency Aggregating IIS Logs

ezajac — Wed, 12 Sep 2012 19:37:58 GMT

I have an index to consolidate the IIS logs for an application. I have 6 servers that handle load balancing. The IIS logs are in Splunk.

Is there a search parameters can I use to determine the peak concurrent users at a point in time?

Re: Determine Peak Concurrency Aggregating IIS Logs

jonuwz — Wed, 12 Sep 2012 22:41:56 GMT

Do the events contain session ids and logon / logoff event entries ?

If so, you can work out the start of the session, the duration of the session, and use the concurrency search command

Re: Determine Peak Concurrency Aggregating IIS Logs

kristian_kolb — Thu, 13 Sep 2012 07:27:16 GMT

Or if you don't have a really nice way of seeing session start/end, but have a unique identifier for visitors (like a JSESSIONID), you could fake concurrency with something like;

sourcetype=iis* | timechart span=5m dc(JSESSIONID) AS concurrent_users

which will give you a fairly good of the number of active users for each 5 minute period.

Re: Determine Peak Concurrency Aggregating IIS Logs

johnmca — Thu, 13 Sep 2012 17:48:05 GMT

If you are capturing ClientIP and UserAgent you can use that to define a unique vistor. Just depends on how you want to define a visitor.

| eval uniqueVisitor=(ClientIP + ClientUserAgent) | timechart span=5m dc(uniqueVisitor) as uniqueVistor.

Check out the Web intelligence app to. It has a lot of good views and searches available.