https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-graph-that-shows-number-of-active-users-over/m-p/341500#M22197 <P>Something like</P> <PRE><CODE> index=foo sourcetype=bar ssh | stats count by date_hour </CODE></PRE> Wed, 31 Jan 2018 23:37:40 GMT davpx 2018-01-31T23:37:40Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-graph-that-shows-number-of-active-users-over/m-p/341499#M22196 <P>I'm trying to determine what hours over 7 days our ftp server has the lowest activity, or when no one is logged in.</P> <P>Logging is captured by session, example below.</P> <P>I'd like to produce a graph if possible that shows last 7 days number of active users over 1 hour timespan.</P> <PRE><CODE>2018-01-31 06:28:39 110.10.10.10 - someuser [181000]quit - - 221 - - - 22 2018-01-31 06:28:39 110.10.10.10 - someuser [181000]kick - - 421 - - - 22 2018-01-31 06:28:39 110.10.10.10 - someuser [181000]ssh_disconnect timeout - 421 - - - 22 </CODE></PRE> Wed, 31 Jan 2018 17:12:35 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-graph-that-shows-number-of-active-users-over/m-p/341499#M22196 akblackwel 2018-01-31T17:12:35Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-graph-that-shows-number-of-active-users-over/m-p/341500#M22197 <P>Something like</P> <PRE><CODE> index=foo sourcetype=bar ssh | stats count by date_hour </CODE></PRE> Wed, 31 Jan 2018 23:37:40 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-graph-that-shows-number-of-active-users-over/m-p/341500#M22197 davpx 2018-01-31T23:37:40Z https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-graph-that-shows-number-of-active-users-over/m-p/341501#M22198 <P>create bins of one hours and distinct count the users - you can show this in table or bar/column graph</P> <PRE><CODE>index=yourindex | bin span=1h _time | stats distinct_count(Username) as active_users by _time </CODE></PRE> Thu, 01 Feb 2018 00:18:26 GMT https://community.splunk.com/t5/Dashboards-Visualizations/How-to-create-a-graph-that-shows-number-of-active-users-over/m-p/341501#M22198 nabeel652 2018-02-01T00:18:26Z