Splunk Enterprise

Splunk Query for Dashboard/Search Query/Alert

phanichintha
Path Finder


Hello Splunkers!

 Please find sample Log attached, in this UserId available. Based on this log need Splunk query to create dashboard/search query to get output.

Sample Log.PNG

1. The number of user logins on a Daily, Weekly or Monthly basis. (need a query for this)

2. The number of internal vs external user login trend. (need a query for this)

3. Peak user login time of the day. (need a query for this)

4. Peak user login day of the week. (need a query for this)

5. Average time spent on the Platform by Users. (need a query for this)

Labels (1)
0 Karma
1 Solution

samneo
Explorer
 
 
 

first of all to make this easier and not need a REX if you add | table* at the end does it put all those fields you want into individual tables and of so can you provide the header names of the columns they go into? 

View solution in original post

Tags (1)

samneo
Explorer
 
 
 

first of all to make this easier and not need a REX if you add | table* at the end does it put all those fields you want into individual tables and of so can you provide the header names of the columns they go into? 

View solution in original post

Tags (1)

phanichintha
Path Finder

Hello,

sourcetype="%forge%" source="/home/amadmin/log/authentication.audit.json" eventName=AM-LOGIN-COMPLETED OR eventName=AM-LOGOUT userId=*

Need a query for this: Average time spent on the Platform by Users?

0 Karma

samneo
Explorer
 
 
 

Try something like the below

 

| stats count avg(eventName) by userId

or

| eventstats avg(eventName) as events by userId

 

Try one of them to see if it works for you

Tags (1)
0 Karma

phanichintha
Path Finder

Hello Samneo, Thanks for your query,

I tried for the first case, the snap shows like this. but I need Avg time spent on login and logout by user.

phanichintha_0-1594713123557.png

 

0 Karma

samneo
Explorer
 
 

When you say time spent, do you want to calculate from the time they logged in and then out and then the total to show? 

Tags (1)
0 Karma

phanichintha
Path Finder

Yes, exactly which i mean.

Ex: each user spent how much time on work per day.

0 Karma

phanichintha
Path Finder

Hello Neo/ Anyone,

Can anyone please share your valuable help.

0 Karma

phanichintha
Path Finder

Hello, can anyone help on priority, well appreciated.

0 Karma

phanichintha
Path Finder

Hello, no one has answers for my questions I guess.

0 Karma

sensitive-thug
Community Manager
Community Manager

Hi phanichintha,

This question has been answered and is marked as solved. If you need help with a separate issue, please post a brand new question so your issue can get more visibility.

0 Karma

phanichintha
Path Finder

anyone please update..

Tags (1)
0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!