Determine Peak Concurrency Aggregating IIS Logs

[ezajac]

I have an index to consolidate the IIS logs for an application. I have 6 servers that handle load balancing. The IIS logs are in Splunk.

Is there a search parameters can I use to determine the peak concurrent users at a point in time?

[johnmca]

If you are capturing ClientIP and UserAgent you can use that to define a unique vistor. Just depends on how you want to define a visitor.

| eval uniqueVisitor=(ClientIP + ClientUserAgent) | timechart span=5m dc(uniqueVisitor) as uniqueVistor.

Check out the Web intelligence app to. It has a lot of good views and searches available.

[kristian_kolb]

Or if you don't have a really nice way of seeing session start/end, but have a unique identifier for visitors (like a JSESSIONID), you could fake concurrency with something like;

sourcetype=iis* | timechart span=5m dc(JSESSIONID) AS concurrent_users

which will give you a fairly good of the number of active users for each 5 minute period.

/K

[jonuwz]

Do the events contain session ids and logon / logoff event entries ?

If so, you can work out the start of the session, the duration of the session, and use the concurrency search command