Splunk Enterprise

Splunk Query for Dashboard/Search Query/Alert

Path Finder


Hello Splunkers!

 Please find sample Log attached, in this UserId available. Based on this log need Splunk query to create dashboard/search query to get output.

Sample Log.PNG

1. The number of user logins on a Daily, Weekly or Monthly basis. (need a query for this)

2. The number of internal vs external user login trend. (need a query for this)

3. Peak user login time of the day. (need a query for this)

4. Peak user login day of the week. (need a query for this)

5. Average time spent on the Platform by Users. (need a query for this)

Labels (1)
0 Karma
1 Solution

Explorer
 
 
 

first of all to make this easier and not need a REX if you add | table* at the end does it put all those fields you want into individual tables and of so can you provide the header names of the columns they go into? 

View solution in original post

Tags (1)

Explorer
 
 
 

first of all to make this easier and not need a REX if you add | table* at the end does it put all those fields you want into individual tables and of so can you provide the header names of the columns they go into? 

View solution in original post

Tags (1)

Path Finder

Hello,

sourcetype="%forge%" source="/home/amadmin/log/authentication.audit.json" eventName=AM-LOGIN-COMPLETED OR eventName=AM-LOGOUT userId=*

Need a query for this: Average time spent on the Platform by Users?

0 Karma

Explorer
 
 
 

Try something like the below

 

| stats count avg(eventName) by userId

or

| eventstats avg(eventName) as events by userId

 

Try one of them to see if it works for you

Tags (1)
0 Karma

Path Finder

Hello Samneo, Thanks for your query,

I tried for the first case, the snap shows like this. but I need Avg time spent on login and logout by user.

phanichintha_0-1594713123557.png

 

0 Karma

Explorer
 
 

When you say time spent, do you want to calculate from the time they logged in and then out and then the total to show? 

Tags (1)
0 Karma

Path Finder

Yes, exactly which i mean.

Ex: each user spent how much time on work per day.

0 Karma

Path Finder

Hello Neo/ Anyone,

Can anyone please share your valuable help.

0 Karma

Path Finder

Hello, can anyone help on priority, well appreciated.

0 Karma

Path Finder

Hello, no one has answers for my questions I guess.

0 Karma

Moderator
Moderator

Hi phanichintha,

This question has been answered and is marked as solved. If you need help with a separate issue, please post a brand new question so your issue can get more visibility.

0 Karma

Path Finder

anyone please update..

Tags (1)
0 Karma