Archive

How do you check the number of users who are currently using the system(Splunk web UI login) over the last month?

gkumarashanmuga
Explorer

How do you check the number of users who are currently using the system(Splunk web UI login) over the last month?

Tags (1)
0 Karma
1 Solution

pkeenan87
Communicator

Give this search a shot:

index=_internal sourcetype=splunk_web_access user!="-"
| stats dc(user) AS user_count

View solution in original post

nickhills
Ultra Champion

This will give you the total number of successful logins by user account

index=_audit "login attempt" info=succeeded|stats count by user|sort 0 -count
If my comment helps, please give it a thumbs up!
0 Karma

gkumarashanmuga
Explorer

Thanks nickhillscpl

0 Karma

pkeenan87
Communicator

Give this search a shot:

index=_internal sourcetype=splunk_web_access user!="-"
| stats dc(user) AS user_count

View solution in original post

gkumarashanmuga
Explorer

Thanks pkeenan87

0 Karma