topic Re: How to create a table that will identify student IDs that visit pages outside of what they regularly access? in Splunk Search

How to create a table that will identify student IDs that visit pages outside of what they regularly access?

pavanae — Mon, 07 Nov 2016 16:51:18 GMT

Hi I have a Splunk search as below :

My Search| where date_hour>=19 OR date_hour<7| bin span=1h _time | convert ctime(_time) as Date_and_Time | stats values(page) as page_accessed by user_id| sort-count | head 5 |rename user_id AS Student_id |

Which displays the result as follows :

Student_id                                           page_accessed

A1234                                                HomePage
                                                     SemesterReport

B5678                                                HomePage
                                                     Course_Structure
                                                     Syllabus

A5678                                                Attendance
                                                     HomePage    

B1234                                                CourseStructure

So, now I want to display only the Student_id's who are visiting pages outside of what they regularly access, is it possible to identify that in Splunk?

For example, consider Student id "A1234": Daily he used to access the HomePage, SemesterReport but yesterday he is accessing the CourseStructure Page. I want to see his student-id and what he visited other than what he regularly visited as next the panel.

Re: How to create a table that will identify student IDs that visit pages outside of what they regularly access?

niketn — Mon, 07 Nov 2016 18:22:03 GMT

Following will give you count of various pages accessed for the list of all users. Lower count implies rarely accessed.

your base search
| chart count over user_id by page | rename count as page_accessed

Similarly, you can also reverser user_id and page field as per your need, which will give you a list of all pages and users count for those who accessed the same.

your base search
| chart count over page by user_id |  rename count as page_accessed

While above is statistical function to get data for user logins. What you really want is to detect outliers in user access. Refer to Splunk Machine Learning Toolkit app which has Showcase example to "Detect Outliers in Number of Logins (vs. Predicted Value)"