Hey @santosh12, if @somesoni2 answered your question, please remember to "√Accept" the answer to award karma points and to let other Splunkers know it’s a working solution. We’re hosting a karma point contest, so it’s particularly awesome to up vote on Answers these days. 😄
With this i am getting the user counts but is it for only that particular search head instance or it will return all the users for all the search heads which are in cluster. Because i want to get all the users which are logged into the search head cluster.
Can we run a query in a single instance and get all the users logging into different instances in the search head cluster ?
If you forward internal logs from your search head cluster members to your indexes, the same search would give user count from all members. For more accurate results, add the host names (SHC members) in the query.
index=_internal source=access host=shcmember1 OR host=shcmember2 OR.... l stats count by user