Hello Splunkers!
Please find sample Log attached, in this UserId available. Based on this log need Splunk query to create dashboard/search query to get output.
1. The number of user logins on a Daily, Weekly or Monthly basis. (need a query for this)
2. The number of internal vs external user login trend. (need a query for this)
3. Peak user login time of the day. (need a query for this)
4. Peak user login day of the week. (need a query for this)
5. Average time spent on the Platform by Users. (need a query for this)
first of all to make this easier and not need a REX if you add | table* at the end does it put all those fields you want into individual tables and of so can you provide the header names of the columns they go into?
first of all to make this easier and not need a REX if you add | table* at the end does it put all those fields you want into individual tables and of so can you provide the header names of the columns they go into?
Hello,
sourcetype="%forge%" source="/home/amadmin/log/authentication.audit.json" eventName=AM-LOGIN-COMPLETED OR eventName=AM-LOGOUT userId=*
Need a query for this: Average time spent on the Platform by Users?
Try something like the below
| stats count avg(eventName) by userId
or
| eventstats avg(eventName) as events by userId
Try one of them to see if it works for you
Hello Samneo, Thanks for your query,
I tried for the first case, the snap shows like this. but I need Avg time spent on login and logout by user.
When you say time spent, do you want to calculate from the time they logged in and then out and then the total to show?
Yes, exactly which i mean.
Ex: each user spent how much time on work per day.
Hello Neo/ Anyone,
Can anyone please share your valuable help.
Hello, can anyone help on priority, well appreciated.
Hello, no one has answers for my questions I guess.
Hi phanichintha,
This question has been answered and is marked as solved. If you need help with a separate issue, please post a brand new question so your issue can get more visibility.