Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Getting user count
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Our logs contain user name and the corresponding agile-board he used.
A user might have used multiple agile-boards ; An agile-board could have been used my multiple users.
I'm trying to figure out a count to illustrate 'how many (unique)users' had accessed each agile-board.
====================================================================================
Sample Event:
20.138.409.2 514x265646x9 ZQ93123 [12/Jun/2018:06:54:08 -0400] "POST /rest/analytics/1.0/publish/bulk HTTP/1.1" 200 - 2 "https://phun.mayhem.com/secure/ActivBoard.jspa?agileBord=53322&view=planning&selectedIssue=KK-273" "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 1.0.51727; .NET CLR 5.4.30729; .NET CLR 3.0.30729; Media Center PC 6.0; InfoPath.3; .NET4.0C; .NET4.0E; wbx 1.0.0)" "a7fxqz"
ZQ93123 is the user name and 53322 is the agileBord name.
If one user opens accesses the board, multiple events gets created with the same agile-board name and username. We ought to figure out the unique (total)count of users access per agileboard.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This can be established by a simple distinct count:
...your base search to get to this data...
| rex "^\S+\s+\S+\s+(?<user>\S+)"
| rex "agileBord=(?<agileBord>[^&]+)"
| stats dc(user) by agileBord
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This can be established by a simple distinct count:
...your base search to get to this data...
| rex "^\S+\s+\S+\s+(?<user>\S+)"
| rex "agileBord=(?<agileBord>[^&]+)"
| stats dc(user) by agileBord
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
There is something wrong with my extraction. That's why | stats command work with mine.
Hence raised the question. I could use some help in extraction
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Updated my answer with the rex commands to extract user and agileBord fields. Let me know if that helps 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It does work brilliantly. Thank you.
If I may add one more thing,
Now, I see two columns, agilebord and dc(user) and the agilebord number is like 2234, 6784 etc...
Instead of that can I have some string appended to it , so that the agilebord column looks like this
https://phun.mayhem.com/secure/SuperBoard.jspa?AgileView=2234
https://phun.mayhem.com/secure/SuperBoard.jspa?AgileView=6784
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
sure, just add the following at the end:
| eval agileBord = "https://phun.mayhem.com/secure/SuperBoard.jspa?AgileView=".agileBord
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
SplunkTrust Application Period is Officially OPEN!
