Getting Data In

View Active Web Sessions in Splunk

fisuser1
Contributor

Is there a way to view active, daily "log in" web sessions for a managed site? Would need to create this search and save it as a dashboard... I am already capturing the Apache access log from this site in Splunk and want to see daily successful login metrics.

0 Karma
1 Solution

lukejadamec
Super Champion

You can try this. It extracts user names for sessions out of my access_combined logs.

sourcetype=access_combined "*usernameAttr*" | rex ".*usernameAttr:(?<SessionUserName>\S+)\s.*" |stats count by SessionUserName 

Run for whatever timeframe you like.

View solution in original post

fisuser1
Contributor

Thanks, but not quite what I am looking for... I am looking more for a way to capture the amount of logins per day, or web user load...

0 Karma

lukejadamec
Super Champion

You can try this. It extracts user names for sessions out of my access_combined logs.

sourcetype=access_combined "*usernameAttr*" | rex ".*usernameAttr:(?<SessionUserName>\S+)\s.*" |stats count by SessionUserName 

Run for whatever timeframe you like.

Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...