topic Re: Calculating Active User's in Splunk Search

Calculating Active User's

apalen — Wed, 19 Mar 2014 18:35:54 GMT

I am struggling to find how to write this query to calculate active user's on our system. Currently we have a syslog that logs log in's and log outs. The syslog is on the same host (if that matters) we have a 2nd host that does session time outs which i also want to track as a log out.
I can pull these individually and put them into a time chart easy enough, but combining them has been futile so far.

Re: Calculating Active User's

somesoni2 — Wed, 19 Mar 2014 18:47:55 GMT

Could you provide sample logs or individual queries that you're using?

Re: Calculating Active User's

apalen — Wed, 19 Mar 2014 19:07:42 GMT

logout requested | timechart count
user in session | timechart count

I hope this helps!

Edit: a word

Re: Calculating Active User's

somesoni2 — Wed, 19 Mar 2014 19:18:02 GMT

Try this: (I am not about your exact requirement, just generating combined count for both syslogs)

| multisearch [search logout requested | eval type="syslog"][search user in session | eval type="sessionlog"] | timechart count by type

Re: Calculating Active User's

apalen — Wed, 19 Mar 2014 19:29:36 GMT

Thanks, This is defiantly a step in the right direction, i just need to put in the correct arguments. Im not a programer by any means, so this is quite the struggle for me. I'll keep playing with this try to make some progress.