Hi,
I would like to show the numbers of users and also the number of unique users visiting a particular dashboard. I want to display these numbers somewhere on the dashboard. I have multiple dashboards and would like to do the same for all the dashboards.
Is there an in-built feature/tool in Splunk that does this? or Is using JavaScript a better option for this?
There is no built-in feature that does that. You'll have to search and parse the splunkd_ui_access log for that information.
Hi, @deepikagooty,
You can use the below query to get the number of unique users who accessed the dashboard. You can embed this in your dashboard
index=_internal source=*splunkd_ui_access.log uri_path="*/<dashboard_url_name>" NOT user="-"
|stats dc(user)
Thanks,
Purush
User Monitoring for Splunk - https://splunkbase.splunk.com/app/5484/
Yes, @richgalloway is right!
As our Search Heads are configured with RSA authentication, I created and monitored a local index in Search Head to track the JSON file for each user in SPL.
$SPLUNK_HOME$/etc/app/<app_name(default: radius_auth>>local/user_info/<hash>.json
Could you please elaborate on this. Thank you.
Here is what I could have a summary:
1. Splunk authentication (I call local settings) and all local users' login/password are stored at $SPLUNK_HOME$/etc/passwd file. After users login, their profiles will be located $SPLUNK_HOME$/etc/users/ directory.
2. This is a way that I use to manage the users because I am using radius authentication as mentioned above. I listed the links to download and configure below that I followed so you could do your lab.
After completing the app installation and configuration, logging to SH > Click Settings > Add Data > Files & Directories ($SPLUNK_HOME$/etc/apps/radius_auth/local/user_info directory that will be monitored > follow the rest of the basic process.
Download app: https://splunkbase.splunk.com/app/981/
Configuration the radius access: https://lukemurphey.net/projects/splunk-radius-auth/wiki/Install_and_Configuration
(I could not show you my system snapshot because it is not the lab but if you have one, you could share it.)
There is no built-in feature that does that. You'll have to search and parse the splunkd_ui_access log for that information.
Thanks for the reply @richgalloway The splunkd_ui_access log that I have only shows my activity. Is it because it is on my local machine? If this is deployed on to the production server, Will I be able to get information of all the users accessing that dashboard with the same splunkd_ui_access log file? Please let me know. Thank you.
Since you are the only user (presumably) of your machine only your activity will be in the logs. In a shared environment, the logs will show the activity of all users.