https://community.splunk.com/t5/Splunk-Search/how-to-get-the-number-of-logins-per-user-for-the-past-30-days/m-p/236290#M188560 <P>Logins to what? Which system?</P> Fri, 01 Jul 2016 11:41:05 GMT richgalloway 2016-07-01T11:41:05Z https://community.splunk.com/t5/Splunk-Search/how-to-get-the-number-of-logins-per-user-for-the-past-30-days/m-p/236289#M188559 <P>We want to know how to get the number of logins per user for the past 30 days? and also, if there is a metric we can see how long users are logged into the system . </P> Fri, 01 Jul 2016 06:15:50 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-the-number-of-logins-per-user-for-the-past-30-days/m-p/236289#M188559 kiran_mh 2016-07-01T06:15:50Z https://community.splunk.com/t5/Splunk-Search/how-to-get-the-number-of-logins-per-user-for-the-past-30-days/m-p/236290#M188560 <P>Logins to what? Which system?</P> Fri, 01 Jul 2016 11:41:05 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-the-number-of-logins-per-user-for-the-past-30-days/m-p/236290#M188560 richgalloway 2016-07-01T11:41:05Z https://community.splunk.com/t5/Splunk-Search/how-to-get-the-number-of-logins-per-user-for-the-past-30-days/m-p/236291#M188561 <P>how to get the number of logins per user for the past 30 days <BR /> in splunk<BR /> also, if there is a metric we can see how long users are logged into the splunk </P> <P>We also need to know how much hours a user is accessing splunk per day</P> Fri, 01 Jul 2016 11:45:09 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-the-number-of-logins-per-user-for-the-past-30-days/m-p/236291#M188561 kiran_mh 2016-07-01T11:45:09Z https://community.splunk.com/t5/Splunk-Search/how-to-get-the-number-of-logins-per-user-for-the-past-30-days/m-p/236292#M188562 <P>number of logins : index=_audit info=succeeded action="login attempt" | stats count by user</P> <P>How many hours someone someone is accessing is very hard to get (in my opinion)<BR /> You could calculate the time between login and logout times. BUT most users don't press the logout button, so you don't have the data.</P> <P>So you should track when users fires searches. </P> Fri, 01 Jul 2016 12:00:57 GMT https://community.splunk.com/t5/Splunk-Search/how-to-get-the-number-of-logins-per-user-for-the-past-30-days/m-p/236292#M188562 teunlaan 2016-07-01T12:00:57Z