How do you check the number of users who are currently using the system(Splunk web UI login) over the last month?

[gkumarashanmuga]

How do you check the number of users who are currently using the system(Splunk web UI login) over the last month?

[nickhills]

This will give you the total number of successful logins by user account

index=_audit "login attempt" info=succeeded|stats count by user|sort 0 -count

[gkumarashanmuga]

Thanks nickhillscpl

[pkeenan87 · Accepted solution]

Give this search a shot:

index=_internal sourcetype=splunk_web_access user!="-"
| stats dc(user) AS user_count

[gkumarashanmuga]

Thanks pkeenan87