Splunk Query for Dashboard/Search Query/Alert

[phanichintha]

Hello Splunkers!

 Please find sample Log attached, in this UserId available. Based on this log need Splunk query to create dashboard/search query to get output.

1. The number of user logins on a Daily, Weekly or Monthly basis. (need a query for this)

2. The number of internal vs external user login trend. (need a query for this)

3. Peak user login time of the day. (need a query for this)

4. Peak user login day of the week. (need a query for this)

5. Average time spent on the Platform by Users. (need a query for this)

[samneo · Accepted solution]

first of all to make this easier and not need a REX if you add | table* at the end does it put all those fields you want into individual tables and of so can you provide the header names of the columns they go into? 

[phanichintha]

Hello,

sourcetype="%forge%" source="/home/amadmin/log/authentication.audit.json" eventName=AM-LOGIN-COMPLETED OR eventName=AM-LOGOUT userId=*

Need a query for this: Average time spent on the Platform by Users?

[samneo]

Try something like the below

| stats count avg(eventName) by userId

or

| eventstats avg(eventName) as events by userId

Try one of them to see if it works for you

[phanichintha]

Hello Samneo, Thanks for your query,

I tried for the first case, the snap shows like this. but I need Avg time spent on login and logout by user.

[samneo]

When you say time spent, do you want to calculate from the time they logged in and then out and then the total to show? 

[phanichintha]

Yes, exactly which i mean.

Ex: each user spent how much time on work per day.

[phanichintha]

Hello Neo/ Anyone,

Can anyone please share your valuable help.

[phanichintha]

Hello, can anyone help on priority, well appreciated.

[phanichintha]

Hello, no one has answers for my questions I guess.

[sensitive-thug]

Hi phanichintha,

This question has been answered and is marked as solved. If you need help with a separate issue, please post a brand new question so your issue can get more visibility.

[phanichintha]

anyone please update..