Security

search for Count of users per minute for a hour

ma_anand1984
Contributor

user activities are captured in _audit index. Using this i would like to see how many users are active on a given minute for an hour. I tried this

index=_audit | dedup user | timechart span = "1m" count(user)

but dedup worked on the whole time frame instead of every minute. Any help would be appreciated.

0 Karma
1 Solution

ma_anand1984
Contributor

This is the answer for the requirement i had
index=_audit | timechart span="1m" dc(user)| rename dc(user) as "Concurrent User"

View solution in original post

ma_anand1984
Contributor

This is the answer for the requirement i had
index=_audit | timechart span="1m" dc(user)| rename dc(user) as "Concurrent User"

sdaniels
Splunk Employee
Splunk Employee

Did this work for you?

0 Karma

sdaniels
Splunk Employee
Splunk Employee

What if you do the following:

... | bucket span=1m _time | dedup user, _time | timechart ...

ma_anand1984
Contributor

I want some thing like this

time user count
1m 5
2m 3
3m 20

etc

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...