Splunk Search

How to track number of requests by time made by user

satyannair
New Member

I need to find user's all request times


User Time Count

testuser1 16:01:32 3

testuser1 16:01:33

testuser1 16:01:35

testuser2 16:01:31 2

testuser2 16:01:37

testuser3 16:02:21 4

testuser3 16:02:22

testuser3 16:02:24

testuser3 16:02:26

Basically try to get a user's time spent on the site over multiple requests or clicks or hits.

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

If you have User and Time in separate fields, you could simply search for

your base search | stats count values(Time) by User

If you have to use the event time as parsed by Splunk, you'll use _time instead of Time. Though you'll want to alter how _time is presented...

your base search | eval Time = strftime(_time,"%Y-%m-%d %H:%M:%S") | stats count values(Time) by User

/k

View solution in original post

0 Karma

kristian_kolb
Ultra Champion

If you have User and Time in separate fields, you could simply search for

your base search | stats count values(Time) by User

If you have to use the event time as parsed by Splunk, you'll use _time instead of Time. Though you'll want to alter how _time is presented...

your base search | eval Time = strftime(_time,"%Y-%m-%d %H:%M:%S") | stats count values(Time) by User

/k

0 Karma

satyannair
New Member

Thanks
that did work!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...