How to filter for total number of users on an appliance?

[Anthony3rd]

For Cisco I used the filter below, I will need to add filters for whatever view I am looking for.

I want to look up the total number of users for a specific day of the month on a host.

@

What do I need to add to my filter?

index="its_sslvpn" host=*SIRA* user=*@*

Thank you. 

Anthony

[scelikok]

Hi @Anthony3rd,

You can lower all usernames;

index="its_sslvpn" host=*SIRA* user=*@* date_mday=15
| eval user=lower(user)
| stats dc(user) as user_count by date_month

[scelikok]

Hi @Anthony3rd,

You can try below sample, it will show the unique user count on the 15th day of the month.

index="its_sslvpn" host=*SIRA* user=*@* date_mday=15
| stats dc(user) as user_count by date_month

[Anthony3rd]

scelikok  Can we check for duplicate names?  I'm probably pushing it.   Thank You 

[scelikok]

Hi @Anthony3rd,

Could you please describe more about duplicate names? Since SSL VPN logs can have duplicates as normal. 

[Anthony3rd · Accepted solution]

scelikok

Some users will login like Thomas.Nolan and some will have thomas.nolan.   Would that show up as two users because of Caps?

And, Yes, I was able to use your Seach strings successfully.

Thank you so much.

Anthony

[Anthony3rd]

Thank you for your help scelikok.  In addition to all your help, I believe I found the additional cmd > dedup user

Anthony