Getting Data In

View Active Web Sessions in Splunk

fisuser1
Contributor

Is there a way to view active, daily "log in" web sessions for a managed site? Would need to create this search and save it as a dashboard... I am already capturing the Apache access log from this site in Splunk and want to see daily successful login metrics.

0 Karma
1 Solution

lukejadamec
Super Champion

You can try this. It extracts user names for sessions out of my access_combined logs.

sourcetype=access_combined "*usernameAttr*" | rex ".*usernameAttr:(?<SessionUserName>\S+)\s.*" |stats count by SessionUserName 

Run for whatever timeframe you like.

View solution in original post

fisuser1
Contributor

Thanks, but not quite what I am looking for... I am looking more for a way to capture the amount of logins per day, or web user load...

0 Karma

lukejadamec
Super Champion

You can try this. It extracts user names for sessions out of my access_combined logs.

sourcetype=access_combined "*usernameAttr*" | rex ".*usernameAttr:(?<SessionUserName>\S+)\s.*" |stats count by SessionUserName 

Run for whatever timeframe you like.

Get Updates on the Splunk Community!

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...

What’s New in Splunk Observability Cloud – June 2025

What’s New in Splunk Observability Cloud – June 2025 We are excited to announce the latest enhancements to ...

Almost Too Eventful Assurance: Part 2

Work While You SleepBefore you can rely on any autonomous remediation measures, you need to close the loop ...