I'm looking for an app that does something like Splunk Dashboard Monitoring. Simple page, has all sorts of user stats on it.
Has anyone found something like that?
Thank you!
Not really, but I have made some own dashboards and queries using REST calls:
For example:
Total Users in Splunk---> |rest /servicesNS/-/-/authentication/users splunk_server=local|search NOT tittle=admin|stats count
Current Active User Session in Splunk--> | rest /servicesNS/-/-/authentication/httpauth-tokens splunk_server=local |search NOT userName="splunk-system-user" searchId=""|stats dc(userName) AS count
Splunk User Logon Trend - Daily --> index="_internal" sourcetype=splunkd_access NOT user=splunk-system-user NOT user="-" "/services/authentication/users/"|timechart span=1d count
Splunk USer count by role-->
|rest /servicesNS/-/-/authentication/users |search NOT tittle=admin|table title roles|mvexpand roles|stats dc(title) AS user_count by roles
Not really, but I have made some own dashboards and queries using REST calls:
For example:
Total Users in Splunk---> |rest /servicesNS/-/-/authentication/users splunk_server=local|search NOT tittle=admin|stats count
Current Active User Session in Splunk--> | rest /servicesNS/-/-/authentication/httpauth-tokens splunk_server=local |search NOT userName="splunk-system-user" searchId=""|stats dc(userName) AS count
Splunk User Logon Trend - Daily --> index="_internal" sourcetype=splunkd_access NOT user=splunk-system-user NOT user="-" "/services/authentication/users/"|timechart span=1d count
Splunk USer count by role-->
|rest /servicesNS/-/-/authentication/users |search NOT tittle=admin|table title roles|mvexpand roles|stats dc(title) AS user_count by roles
Awesome! The Total Users and Current Active Users is exactly what I was looking for.
Thank you!
I need to dig more into the rest command, seems like many of my questions come back to that answer.