Splunk IT Service Intelligence

ITSI User usage report

cindywee
New Member

Hi, need some expert help tuning a search query focused only on ITSI users per week. I have the following query but it is running really slow.

index="_internal" host= app=itsi NOT user="splunk-system-user"| timechart span=1d count as count_user by user usenull=f

Any suggestions are welcomed.

Thanks.

0 Karma

stuartidelta01
Path Finder

Try this:

index=_internal host=<insert-your-ITSI-host(s)> source="/opt/splunk/var/log/splunk/splunkd_ui_access.log" uri=*SA-ITOA/itoa_interface* 
|timechart span=1d dc(user) as users
0 Karma

rphillips_splk
Splunk Employee
Splunk Employee

Do you have a more specific goal you are trying to achieve aside from counting events from the itsi app by user? That will help tailor the search requirements.

0 Karma

cindywee
New Member

Hi there. I need to track and report who logged into ITSI, either to view or create glasstables, base searches and entities etc . Thanks.

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...