topic Re: How to find the No. of users using application? in Splunk Search

How to find the No. of users using application?

Ajit — Mon, 06 Mar 2023 14:23:37 GMT

My log contains entries as shown below. 2023-03-03T14:14:12.718, Level=INFO, ProcessName=App-web, Thread=http-nio-80-exec-78, Code=c.m.Config, Message={"clientIp":"192.168.12.24","cost":1,"method":"GET","reqParam":{"userId":["25632"]},"resp":"{\"code\":1,\"data\":{\"list\":[{\"createDate\":1656942857926,\"groupId\":1000023,\"id\":1173,\"lastUpdate\":16569","user":"myemail@hotmail.com"} I want to know how many users are using the application in last one hour.

Re: No. of users using application

yuanliu — Sat, 04 Mar 2023 10:59:00 GMT

First, I think your log probably look like this instead:

2023-03-03T14:14:12.718, Level=INFO, ProcessName=App-web, Thread=http-nio-80-exec-78, Code=c.m.Config, Message={"clientIp":"192.168.12.24","cost":1,"method":"GET","reqParam":{"userId":["25632"]},"resp":"{\"code\":1,\"data\":{\"list\":[{\"createDate\":1656942857926,\"groupId\":1000023,\"id\":1173,\"lastUpdate\":16569\",\"user\":\"myemail@hotmail.com\"}]}}"}

Second, you need to explain which field/node in Message represents a "user" in your question. If I have to speculate, it is either userId in reqParam or data.user in resp; I further speculate that neither field, especially userId, can have multiple values in a single transaction. So, I'll use this field.

| eval Message = replace(_raw, ".+,\s *Message=", "") | spath input=Message | stats dc('reqParam.userId{}') as unique_users

Re: How to find the No. of users using application?

Ajit — Tue, 07 Mar 2023 14:41:48 GMT

Thanks @yuanliu

Below query worked for me.

| eval Message = replace(_raw, ".+,\s *Message=", "") | spath input=Message | stats dc(user) as unique_users