How can we get total number of users accessing the search head clusters from one instance?

[santosh12]

We have created a search head cluster where we have 3 instance which are in cluster we are looking to get the number of users accessing the apps and get there count from one instance.

[lfedak_splunk]

Hey @santosh12, if @somesoni2 answered your question, please remember to "√Accept" the answer to award karma points and to let other Splunkers know it’s a working solution. We’re hosting a karma point contest, so it’s particularly awesome to up vote on Answers these days. 😄

[peterchenadded]

Check in your _internal logs

E.g.

index=_internal source=access l stats count by user

[santosh12]

Hi,

Thanks Peter.

With this i am getting the user counts but is it for only that particular search head instance or it will return all the users for all the search heads which are in cluster. Because i want to get all the users which are logged into the search head cluster.

Can we run a query in a single instance and get all the users logging into different instances in the search head cluster ?

Regards,
Santosh.

[somesoni2]

If you forward internal logs from your search head cluster members to your indexes, the same search would give user count from all members. For more accurate results, add the host names (SHC members) in the query.

index=_internal source=access host=shcmember1 OR host=shcmember2 OR.... l stats count by user