- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Calculating Active User's
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am struggling to find how to write this query to calculate active user's on our system. Currently we have a syslog that logs log in's and log outs. The syslog is on the same host (if that matters) we have a 2nd host that does session time outs which i also want to track as a log out.
I can pull these individually and put them into a time chart easy enough, but combining them has been futile so far.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this: (I am not about your exact requirement, just generating combined count for both syslogs)
| multisearch [search logout requested | eval type="syslog"][search user in session | eval type="sessionlog"] | timechart count by type
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this: (I am not about your exact requirement, just generating combined count for both syslogs)
| multisearch [search logout requested | eval type="syslog"][search user in session | eval type="sessionlog"] | timechart count by type
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks, This is defiantly a step in the right direction, i just need to put in the correct arguments. Im not a programer by any means, so this is quite the struggle for me. I'll keep playing with this try to make some progress.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
logout requested | timechart count
user in session | timechart count
I hope this helps!
Edit: a word
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Could you provide sample logs or individual queries that you're using?
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
