topic Re: Count users' successful logins over time in Splunk Search

Count users' successful logins over time

DanAlexander — Thu, 21 Sep 2023 20:23:34 GMT

I would like to get the number of people connected (one successful login session per user per day will suffice) to our network over a month period using earliest and now() attributes. The figures should be presented per week like a chart

Re: Count users' successful logins over time

yuanliu — Thu, 21 Sep 2023 23:38:12 GMT

You have to tell volunteers how your data looks like. Forget Splunk. How do you tell there is a new login, how do you tell a new login is successful from your data?

Suppose your data have three fields, user, event, and status, where event "login" signifies a new login, and status "success" signifies success. A generic way to do this would be

<some other selectors> event=login status=success earliest=-1mon | timechart span=1d count by user

Re: Count users' successful logins over time

bowesmana — Fri, 22 Sep 2023 02:08:36 GMT

When you say per day and per week do you mean you want unique user count in a week as long as a person logged in once in that week, or do you want to show a daily unique user count AND a weekly unique user count?

Building on @yuanliu comments, to get count of users per day then it's

<some other selectors> event=login status=success earliest=-1mon | timechart span=1w@w dc(user) as users

will give you a weekly unique count from Sun->Sat

If you want to get unique by day as well as by week, then do the daily dc() count and save the values and then after bin by week and add in the dc() count for the week