topic Re: How to filter the Userid to show once per minute? in Splunk Search

How to filter the Userid to show once per minute?

moiezuddin — Mon, 06 Apr 2015 13:54:46 GMT

In the index for siteminder called cams_prod, there are traced filed with the type smtrace. Using these trace files find the logs for the application using 'Center realm’. Then created a regular expression to mine the User id. You will notice that Userids are able to be found many times each minute. We need to fiter this so it only shows once per minute.

Re: How to filter the Userid to show once per minute?

masonmorales — Mon, 06 Apr 2015 14:36:29 GMT

Could you post some sample data, your current search, and a mock-up of your desired output please?

Re: How to filter the Userid to show once per minute?

NOUMSSI — Tue, 07 Apr 2015 01:48:22 GMT

Hi,
to show only one Userid per minute, in your query use this function dc by this way:

...|stats dc(Userid) by ...

...|timechart dc(Userid) by ...

Re: How to filter the Userid to show once per minute?

moiezuddin — Mon, 28 Sep 2020 19:25:58 GMT

index=casm_prod sourcetype=smtrace | bucket _time span=1m | stats count by _time, USER_id | sort - count

With the above query, I noticed that USER_id are able to be found many times each minute.

I need to fiter this in such a way that it only needs to shows once per minute.

Kindly help

Re: How to filter the Userid to show once per minute?

moiezuddin — Mon, 28 Sep 2020 19:26:01 GMT

index=casm_prod sourcetype=smtrace | bucket _time span=1m | stats count by _time, USER_id | sort - count

With the above query, I noticed that USER_id are able to be found many times each minute.

I need to fiter this in such a way that it only needs to shows once per minute.

Kindly help

Re: How to filter the Userid to show once per minute?

NOUMSSI — Tue, 07 Apr 2015 10:02:20 GMT

Ok guy,

Try this with the commande dedup:

 ...|stats dc(User_id) by ... | dedup USER_id sortby +_time

Or this with commande uniq:

index=casm_prod sourcetype=smtrace | bucket _time span=1m | stats count by _time, USER_id | sort - count |uniq

Re: How to filter the Userid to show once per minute?

moiezuddin — Tue, 07 Apr 2015 10:39:01 GMT

Thanks a lot , its working fine.

Re: How to filter the Userid to show once per minute?

NOUMSSI — Tue, 07 Apr 2015 10:59:27 GMT

No mention. I'm here to help you solve your problems

Re: How to filter the Userid to show once per minute?

krishnacasso — Tue, 01 Mar 2016 20:07:21 GMT

Hi Moiezuddin,

Thanks For the question,
I new to splunk, Trying to develop some sample siteminder dashboards as a poc,
Hope you have some Idea on the smaccess log and smps log,

Using Smps log, We are trying to develop some alerts for the performance monitoring of siteminder.
Can you please explain if you have done any in your environment.

Was It possible to create a table like total number users have accessed a particular application in 24 hours time period using azaccept and uid in smaccess.log

Thanks,