How do you check the number of users who are currently using the system(Splunk web UI login) over the last month?
Give this search a shot:
index=_internal sourcetype=splunk_web_access user!="-"
| stats dc(user) AS user_count
This will give you the total number of successful logins by user account
index=_audit "login attempt" info=succeeded|stats count by user|sort 0 -count
Thanks nickhillscpl
Give this search a shot:
index=_internal sourcetype=splunk_web_access user!="-"
| stats dc(user) AS user_count
Thanks pkeenan87