Getting Data In

Active User count in the application not working

praneethlekkala
Path Finder

I want to know the active user count of an application, the following is the query i created, however its not giving the out put, can someone guide please?

 

index=application host=Server Name sourcetype="Applicationprod-console-logs" "[AccessLogFilter]"
| rex "^\S+ \S+ \S+ \S+ \S+ (?<USER>\S+) (?<ACTION>\S+) (?<URL>\S+) (?<SIZE>\d+)kb"
| timechart span=15m dc(USER) as Application _User

I am getting the following out put:

_time                                        application_User
1 2021-11-09 00:00:00        0
2 2021-11-09 00:15:00        0
3 2021-11-09 00:30:00        0
4 2021-11-09 00:45:00        0

 

The Logs if i run the following query shows that there is the User ID in the output:

index=application host=Server Name sourcetype="Applicationprod-console-logs" "[AccessLogFilter]"

Output:

2021-11-09 08:29:12,787 INFO [http-nio-127.0.0.1-8085-exec-101 url: /deploy/viewDeploymentProjectEnvironments.action] [AccessLogFilter] USERID GET application.url.action?id=665059902 4320055kb
host = Server source = location = application-prod-console-logs

Labels (2)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

When I tried the regex in regex101.com there were no matches.  Removing the leading anchor fixed it.

| rex "\S+ \S+ \S+ \S+ \S+ (?<USER>\S+) (?<ACTION>\S+) (?<URL>\S+) (?<SIZE>\d+)kb"

FWIW, this regex is faster

| rex "url: [^\]]+\] \[\S+] (?<USER>\S+) (?<ACTION>\S+) (?<URL>\S+) (?<SIZE>\d+)kb"
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

When I tried the regex in regex101.com there were no matches.  Removing the leading anchor fixed it.

| rex "\S+ \S+ \S+ \S+ \S+ (?<USER>\S+) (?<ACTION>\S+) (?<URL>\S+) (?<SIZE>\d+)kb"

FWIW, this regex is faster

| rex "url: [^\]]+\] \[\S+] (?<USER>\S+) (?<ACTION>\S+) (?<URL>\S+) (?<SIZE>\d+)kb"
---
If this reply helps you, Karma would be appreciated.

praneethlekkala
Path Finder

@richgalloway  Thanks, It worked!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...