Splunk Search

Count of Active users as well as Active bots

New Member

Dear Friends,

I am trying to stats count of Users and bots, separately,

sourcetype=access_combined | eval VSTR_TYPE =case( like(VSTR_GUID, "%%"),"ACTIVE_USER", VSTR_GUID="-","ACTIVE_BOT")| search VSTR_TYPE=* | stats dc(VSTR_IP) as COUNT by VSTR_TYPE  

Here i am only getting VSTR_TYPE as ACTIVE_USER, I am not getting any count for ACTIVE_BOT, however i can see my log message are having event where VSTR_GUID="-", can please help me in that, where i am doing wrong or is there any better way of doing that, where i can get count of all unique VSTR_IP where VSTR_GUID is present and also i can get count of all unique VSTR_IP where VSTR_GUID is null ("-"). Your help will be appreciated.

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try swapping the two parts of the case() expression. The like() should match when the GUID is "-", putting all bots as users.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try swapping the two parts of the case() expression. The like() should match when the GUID is "-", putting all bots as users.

View solution in original post

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!