Struggling with rex - Need to build a dashboard of concurrent users

[pramsey]

Every hour, we have a group of devices that send out a similar log:

Feb 16 03:01:00 DeviceNameA.domain.com 2014-02-16 03:01:00 - DeviceNameA - [127.0.0.1] System()[] - Number of concurrent users logged in to the device: 35

Feb 16 03:01:00 DeviceNameB.domain.com 2014-02-16 03:01:00 - DeviceNameB - [127.0.0.1] System()[] - Number of concurrent users logged in to the device: 68

Feb 16 03:01:00 DeviceNameC.domain.com 2014-02-16 03:01:00 - DeviceNameC - [127.0.0.1] System()[] - Number of concurrent users logged in to the device: 170

My goal is to build a dashboard that lists all the devices and how many users are currently logged in (for the past hour), then add all 24 hours up for the past day, then add all the days up for the past week, then all the weeks up for the past month, etc...

Brand new to splunk. I think what I am trying to do is turn the string of text "Number of concurrent users logged in to the device:" into a field and then I will be able run a report on that field, then add that report to a dashboard.

After a few hours of muddeling through the field extraction tool, I never got the expected result in the tool, but I was able to generate a query based on the regex it gave me. see below.

"concurrent users logged in to the device" | rex field=_raw "search.(?i)^(?:[^-]*-){9}\s+(?P\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+:)"

Does this mean I now have a field called ConcurrentUsers in this particular query? When I run the query, splunk highlights "concurrent users logged in to the device" like I would expect and does not return an error. Now what? 🙂

[yannK]

Here is a lighter version of the regex, you can use it to create an automatic field extraction, or keep the rex command.

"Number of concurrent users logged in to the device: (<concurrentusers>\d+)"

Do the same for the device name. Then you can check the evolution over the time with a search like. Using the max and average a good way.

source=mysource | timechart span=1h max(concurrentusers) by device

Then if you want to show last our, then previous days average, check those techniques :

• http://answers.splunk.com/answers/30430/previous-business-week-day
• http://answers.splunk.com/answers/50998/day-of-the-week-table-current-day-vs-monthly-avg
• http://answers.splunk.com/answers/86475/compare-a-previous-result
• maybe report acceleration can help too.

[pramsey]

Hi yannK, thanks for the response. I am not sure I am following though. I tried different iterations of what you have with various errors. Can you put in the entire query you would run in order to produce the expected results?