topic Re: Total Number of users on a appliance in Splunk Search

How to filter for total number of users on an appliance?

Anthony3rd — Fri, 27 Jan 2023 19:38:54 GMT

For Cisco I used the filter below, I will need to add filters for whatever view I am looking for.

I want to look up the total number of users for a specific day of the month on a host.

What do I need to add to my filter?

index="its_sslvpn" host=*SIRA* user=*@*

Thank you.

Anthony

scelikok — Fri, 27 Jan 2023 17:34:09 GMT

You can try below sample, it will show the unique user count on the 15th day of the month.

index="its_sslvpn" host=*SIRA* user=*@* date_mday=15 | stats dc(user) as user_count by date_month

Anthony3rd — Fri, 27 Jan 2023 19:00:15 GMT

scelikok

Some users will login like Thomas.Nolan and some will have thomas.nolan. Would that show up as two users because of Caps?

And, Yes, I was able to use your Seach strings successfully.

Thank you so much.

Anthony

scelikok — Fri, 27 Jan 2023 19:05:43 GMT

You can lower all usernames;

index="its_sslvpn" host=*SIRA* user=*@* date_mday=15 | eval user=lower(user) | stats dc(user) as user_count by date_month

Anthony3rd — Fri, 27 Jan 2023 20:38:17 GMT

scelikok Can we check for duplicate names? I'm probably pushing it. Thank You

scelikok — Sat, 28 Jan 2023 06:41:23 GMT

Could you please describe more about duplicate names? Since SSL VPN logs can have duplicates as normal.

Anthony3rd — Mon, 30 Jan 2023 13:54:30 GMT

Thank you for your help scelikok. In addition to all your help, I believe I found the additional cmd > dedup user

Anthony