All Apps and Add-ons

How to cluster user based on number of jobs run in Splunk Machine Learning Toolkit?

jcvytla
New Member

I have around 300 different users and I wanted to cluster them based on a number of jobs run. Can you please let me know how can I based the number of jobs run?

And what if I wanted to cluster them on an hourly scale when we have required fields?

0 Karma

deepashri_123
Motivator

Hey@jcvytla,

Can you try something like this:

index=_audit action=search info=granted search=* NOT "search_id='scheduler" NOT "search='|history" NOT "user=splunk-system-user" NOT "search='typeahead" NOT "search='| metadata type=* | search totalCount>0" |table user search maxtime timestamp
And later you may add timechart as per your requirement.

Let me know if this helps!!

0 Karma

jcvytla
New Member

Thanks for your solution. But, It does't seem to work. I don't get any error but data is not being populated.

Thanks

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...