Monitoring Splunk

How can we get total number of users accessing the search head clusters from one instance?

santosh12
New Member

We have created a search head cluster where we have 3 instance which are in cluster we are looking to get the number of users accessing the apps and get there count from one instance.

0 Karma

lfedak_splunk
Splunk Employee
Splunk Employee

Hey @santosh12, if @somesoni2 answered your question, please remember to "√Accept" the answer to award karma points and to let other Splunkers know it’s a working solution. We’re hosting a karma point contest, so it’s particularly awesome to up vote on Answers these days. 😄

0 Karma

peterchenadded
Path Finder

Check in your _internal logs

E.g.

index=_internal source=access l stats count by user

0 Karma

santosh12
New Member

Hi,

Thanks Peter.

With this i am getting the user counts but is it for only that particular search head instance or it will return all the users for all the search heads which are in cluster. Because i want to get all the users which are logged into the search head cluster.

Can we run a query in a single instance and get all the users logging into different instances in the search head cluster ?

Regards,
Santosh.

0 Karma

somesoni2
Revered Legend

If you forward internal logs from your search head cluster members to your indexes, the same search would give user count from all members. For more accurate results, add the host names (SHC members) in the query.

index=_internal source=access host=shcmember1 OR host=shcmember2 OR.... l stats count by user
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!