Splunk Search

How to filter for total number of users on an appliance?

Anthony3rd
Explorer

For Cisco I used the filter below, I will need to add filters for whatever view I am looking for.

I want to look up the total number of users for a specific day of the month on a host.

@

What do I need to add to my filter?

 

index="its_sslvpn" host=*SIRA* user=*@*

 

Thank you. 

Anthony

 

Labels (1)
0 Karma
1 Solution

Anthony3rd
Explorer

scelikok

Some users will login like Thomas.Nolan and some will have thomas.nolan.   Would that show up as two users because of Caps?

And, Yes, I was able to use your Seach strings successfully.

Thank you so much.

Anthony

View solution in original post

0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Anthony3rd,

You can lower all usernames;

index="its_sslvpn" host=*SIRA* user=*@* date_mday=15
| eval user=lower(user)
| stats dc(user) as user_count by date_month

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

scelikok
SplunkTrust
SplunkTrust

 

Hi @Anthony3rd,

You can try below sample, it will show the unique user count on the 15th day of the month.

index="its_sslvpn" host=*SIRA* user=*@* date_mday=15
| stats dc(user) as user_count by date_month

 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

Anthony3rd
Explorer

scelikok  Can we check for duplicate names?  I'm probably pushing it.   Thank You 

Tags (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @Anthony3rd,

Could you please describe more about duplicate names? Since SSL VPN logs can have duplicates as normal. 

If this reply helps you an upvote and "Accept as Solution" is appreciated.
0 Karma

Anthony3rd
Explorer

scelikok

Some users will login like Thomas.Nolan and some will have thomas.nolan.   Would that show up as two users because of Caps?

And, Yes, I was able to use your Seach strings successfully.

Thank you so much.

Anthony

0 Karma

Anthony3rd
Explorer

Thank you for your help scelikok.  In addition to all your help, I believe I found the additional cmd > dedup user

Anthony 

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...