Active User count in the application not working

[praneethlekkala]

I want to know the active user count of an application, the following is the query i created, however its not giving the out put, can someone guide please?

index=application host=Server Name sourcetype="Applicationprod-console-logs" "[AccessLogFilter]"
| rex "^\S+ \S+ \S+ \S+ \S+ (?<USER>\S+) (?<ACTION>\S+) (?<URL>\S+) (?<SIZE>\d+)kb"
| timechart span=15m dc(USER) as Application _User

I am getting the following out put:

_time                                        application_User
1 2021-11-09 00:00:00        0
2 2021-11-09 00:15:00        0
3 2021-11-09 00:30:00        0
4 2021-11-09 00:45:00        0

The Logs if i run the following query shows that there is the User ID in the output:

index=application host=Server Name sourcetype="Applicationprod-console-logs" "[AccessLogFilter]"

Output:

2021-11-09 08:29:12,787 INFO [http-nio-127.0.0.1-8085-exec-101 url: /deploy/viewDeploymentProjectEnvironments.action] [AccessLogFilter] USERID GET application.url.action?id=665059902 4320055kb
host = Server source = location = application-prod-console-logs

[richgalloway · Accepted solution]

When I tried the regex in regex101.com there were no matches.  Removing the leading anchor fixed it.

| rex "\S+ \S+ \S+ \S+ \S+ (?<USER>\S+) (?<ACTION>\S+) (?<URL>\S+) (?<SIZE>\d+)kb"

FWIW, this regex is faster

| rex "url: [^\]]+\] \[\S+] (?<USER>\S+) (?<ACTION>\S+) (?<URL>\S+) (?<SIZE>\d+)kb"

[praneethlekkala]

@richgalloway  Thanks, It worked!!