Getting Data In

View Active Web Sessions in Splunk

fisuser1
Contributor

Is there a way to view active, daily "log in" web sessions for a managed site? Would need to create this search and save it as a dashboard... I am already capturing the Apache access log from this site in Splunk and want to see daily successful login metrics.

0 Karma
1 Solution

lukejadamec
Super Champion

You can try this. It extracts user names for sessions out of my access_combined logs.

sourcetype=access_combined "*usernameAttr*" | rex ".*usernameAttr:(?<SessionUserName>\S+)\s.*" |stats count by SessionUserName 

Run for whatever timeframe you like.

View solution in original post

fisuser1
Contributor

Thanks, but not quite what I am looking for... I am looking more for a way to capture the amount of logins per day, or web user load...

0 Karma

lukejadamec
Super Champion

You can try this. It extracts user names for sessions out of my access_combined logs.

sourcetype=access_combined "*usernameAttr*" | rex ".*usernameAttr:(?<SessionUserName>\S+)\s.*" |stats count by SessionUserName 

Run for whatever timeframe you like.

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...