Dashboards & Visualizations

How to create a graph that shows number of active users over time?

akblackwel
Loves-to-Learn

I'm trying to determine what hours over 7 days our ftp server has the lowest activity, or when no one is logged in.

Logging is captured by session, example below.

I'd like to produce a graph if possible that shows last 7 days number of active users over 1 hour timespan.

2018-01-31 06:28:39 110.10.10.10 - someuser [181000]quit - - 221 - - - 22 
2018-01-31 06:28:39 110.10.10.10 - someuser [181000]kick - - 421 - - - 22 
2018-01-31 06:28:39 110.10.10.10 - someuser [181000]ssh_disconnect timeout - 421 - - - 22 
Tags (2)
0 Karma

nabeel652
Builder

create bins of one hours and distinct count the users - you can show this in table or bar/column graph

index=yourindex | bin span=1h _time | stats distinct_count(Username) as active_users by _time
0 Karma

davpx
Communicator

Something like

 index=foo sourcetype=bar ssh | stats count by date_hour
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...