Daily maximum of concurrent Logins

[pytb]

Hi, I'm very new to Splunk and would appreciate some help getting started. My logfile is comprised of messages with either "Login" or "Logout" in the text along with a date & time. I would like a report/graph by day, showing the highest number of concurrent logins reached for each day.
Thanks in advance

[pytb]

Thanks everyone, I think I figured it out but it looks pretty messy:

"Login" OR "Disconnected" | eval count_adj = if(like(Message,"%Login%"),1,-1) | accum count_adj as count_max | eval count_max = if(count_max<0,0,count_max) | timechart max(count_max) span=1d

Just curious if there's a better way?

[yannK]

I suppose that you mean that with a log like

2013/11/28 10:00:00 user=a action=login
2013/11/28 12:00:00 user=b action=login
2013/11/28 13:00:00 user=b action=logout
2013/11/28 15:00:00 user=a action=logout

you are looking to something like the hourly concurrency.


2013/11/28 09:00:00 concurrency=0
2013/11/28 10:00:00 concurrency=1
2013/11/28 11:00:00 concurrency=1
2013/11/28 12:00:00 concurrency=2 <--- max
2013/11/28 13:00:00 concurrency=1
2013/11/28 14:00:00 concurrency=1
2013/11/28 15:00:00 concurrency=1
2013/11/28 16:00:00 concurrency=0

with a simple action=login| bucket _time span=1h | stats dc(user) by _time
you will only see the hours when the login occur, not the hours while the login is still active.

Look for the command makecontinuous to expand your login status

[MelanieStrathde]

Hey pytb,
Not 100% sure what you mean.

I'm guessing here but are you wanting to compare the login in and logout event for a username or ipaddress and then work out at what point in time you had the highest number of users?
Is that what you're after?

It might be worth adding a couple of lines of your csv just to help clarify.

[yAlff]

Hello pytb,

i'm not sure what you mean with concurrent logins reached for each day, but maybe take a look at http://docs.splunk.com/Documentation/Splunk/5.0.2/SearchReference/Timechart#More_examples.

So, just add | timechart span=1d to your search string and you will get a timechart. You can visualize this timechart as line or whatever you want to use.