I have an index to consolidate the IIS logs for an application. I have 6 servers that handle load balancing. The IIS logs are in Splunk.
Is there a search parameters can I use to determine the peak concurrent users at a point in time?
If you are capturing ClientIP and UserAgent you can use that to define a unique vistor. Just depends on how you want to define a visitor.
| eval uniqueVisitor=(ClientIP + ClientUserAgent) | timechart span=5m dc(uniqueVisitor) as uniqueVistor.
Check out the Web intelligence app to. It has a lot of good views and searches available.
Or if you don't have a really nice way of seeing session start/end, but have a unique identifier for visitors (like a JSESSIONID), you could fake concurrency with something like;
sourcetype=iis* | timechart span=5m dc(JSESSIONID) AS concurrent_users
which will give you a fairly good of the number of active users for each 5 minute period.
Do the events contain session ids and logon / logoff event entries ?
If so, you can work out the start of the session, the duration of the session, and use the concurrency search command