https://community.splunk.com/t5/Splunk-Search/distinct-count-users-timechart/m-p/40151#M9233 <P>Hello,</P> <P>We are trying to track distinct current users logged in and running transactions in a particular application but cannot seem to get the correct search. Our search right now is just index=cerner | timechart span=5m dc(UserName) by host | addtotals but one of the major flaws is that within that 5min aggregation window where splunk is tallying up the users the graph shows drastic spikes which will confuse our operations center and think that there is something wrong with the application. What would be the best modification to our search syntax to ensure an accurate count of users currently logged in. If the search has to be 5 min in the past I am fine with that.</P> <P>Thanks!</P> <P><IMG src="http://splunk-base.splunk.com//storage/2013-05-20_1408.png" alt="alt text" /></P> <P>Thanks for your feedback.</P> <P>I made the changes and even had it offset to 5min before but it is still showing the drastic drops although the 5 min bucket window has passed. I ran the search at 8:27 an the data point at 8:20 should be accurate. Any other ideas?</P> <P>Thanks<IMG src="http://splunk-base.splunk.com//storage/Capture_5.png" alt="alt text" /></P> Mon, 20 May 2013 18:11:58 GMT aaronkorn 2013-05-20T18:11:58Z https://community.splunk.com/t5/Splunk-Search/distinct-count-users-timechart/m-p/40151#M9233 <P>Hello,</P> <P>We are trying to track distinct current users logged in and running transactions in a particular application but cannot seem to get the correct search. Our search right now is just index=cerner | timechart span=5m dc(UserName) by host | addtotals but one of the major flaws is that within that 5min aggregation window where splunk is tallying up the users the graph shows drastic spikes which will confuse our operations center and think that there is something wrong with the application. What would be the best modification to our search syntax to ensure an accurate count of users currently logged in. If the search has to be 5 min in the past I am fine with that.</P> <P>Thanks!</P> <P><IMG src="http://splunk-base.splunk.com//storage/2013-05-20_1408.png" alt="alt text" /></P> <P>Thanks for your feedback.</P> <P>I made the changes and even had it offset to 5min before but it is still showing the drastic drops although the 5 min bucket window has passed. I ran the search at 8:27 an the data point at 8:20 should be accurate. Any other ideas?</P> <P>Thanks<IMG src="http://splunk-base.splunk.com//storage/Capture_5.png" alt="alt text" /></P> Mon, 20 May 2013 18:11:58 GMT https://community.splunk.com/t5/Splunk-Search/distinct-count-users-timechart/m-p/40151#M9233 aaronkorn 2013-05-20T18:11:58Z https://community.splunk.com/t5/Splunk-Search/distinct-count-users-timechart/m-p/40152#M9234 <P>Could be you need to play with the <CODE>partial</CODE> parameter. If you run a search at say 10:06, with <CODE>span=5m</CODE> your last timeslot will only have data for 1 minute (but be graphed like it had 5 minutes worth of data). </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Timechart">http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Timechart</A></P> <P>/k</P> Mon, 20 May 2013 19:52:50 GMT https://community.splunk.com/t5/Splunk-Search/distinct-count-users-timechart/m-p/40152#M9234 kristian_kolb 2013-05-20T19:52:50Z https://community.splunk.com/t5/Splunk-Search/distinct-count-users-timechart/m-p/40153#M9235 <P>thanks for your feedback. I just updated the original question trying the partial parameter.</P> Tue, 21 May 2013 12:30:15 GMT https://community.splunk.com/t5/Splunk-Search/distinct-count-users-timechart/m-p/40153#M9235 aaronkorn 2013-05-21T12:30:15Z https://community.splunk.com/t5/Splunk-Search/distinct-count-users-timechart/m-p/40154#M9236 <P>I couldn't figure out how to PM you from here. How are you accounting for number of users logged into Cerner? Are you getting the EMR logs from the backend, logging citrix application opens, full app launches from the desktop, or some other way I am not thinking of. I too am part of a Cerner shop and didn't realize someone else out there was tracking this as well.</P> Tue, 21 Jan 2014 02:40:45 GMT https://community.splunk.com/t5/Splunk-Search/distinct-count-users-timechart/m-p/40154#M9236 antlefebvre 2014-01-21T02:40:45Z