Monitoring Splunk

How can we get total number of users accessing the search head clusters from one instance?

santosh12
New Member

We have created a search head cluster where we have 3 instance which are in cluster we are looking to get the number of users accessing the apps and get there count from one instance.

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @santosh12, if @somesoni2 answered your question, please remember to "√Accept" the answer to award karma points and to let other Splunkers know it’s a working solution. We’re hosting a karma point contest, so it’s particularly awesome to up vote on Answers these days. 😄

0 Karma

peterchenadded
Path Finder

Check in your _internal logs

E.g.

index=_internal source=access l stats count by user

0 Karma

santosh12
New Member

Hi,

Thanks Peter.

With this i am getting the user counts but is it for only that particular search head instance or it will return all the users for all the search heads which are in cluster. Because i want to get all the users which are logged into the search head cluster.

Can we run a query in a single instance and get all the users logging into different instances in the search head cluster ?

Regards,
Santosh.

0 Karma

somesoni2
Revered Legend

If you forward internal logs from your search head cluster members to your indexes, the same search would give user count from all members. For more accurate results, add the host names (SHC members) in the query.

index=_internal source=access host=shcmember1 OR host=shcmember2 OR.... l stats count by user
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...