Splunk Search

Beginner Question ! - reporting ps output

ritemple
New Member

I have setup a splunk server and one lightforwarder client. This is configured to send the output of ps every 30 seconds to the server.

On our applications servers, I can easily count the number of connected users with the output of "ps -ef | grep | wc -l". I'd like to be able to use splunk to report this information, something like a report we run weekly (or is generated) showing the maximum number of connections on each day to the server(s).

I'm guessing it's a basic question, but any help getting started with this is appreciated !

Richard

Tags (1)
0 Karma

David
Splunk Employee
Splunk Employee

I believe multikv will be your road to success. Here is a blog post dedicated specifically to grabbing ps output in splunk: http://blogs.splunk.com/2007/08/23/ripping-mulitline-events-at-seach-time/

I think what you'll end up wanting to do is something like the following:

YourPSSearch | multikv filter CriteriaToIdentifyUserSessions | stats count as NumberOfConnectedUsers

Or alternatively, if the filter clause isn't quite powerful enough, you could run a second search afterward. I'd imagine this is slower, though:

YourPSSearch | multikv | search CriteriaToIdentifyUserSessions | stats count as NumberOfConnectedUsers

Hopefully that should get you close to where you want to be.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...