IIS log user count

[ashabc]

My purpose is to count currently logged in user for a web site

Easiest way to get this is something like | stats dc(cs_username)

However, that really does not reflect true numbers that I am after as there could be one username logged in from different client machines simultaneously. Also, it is possible that users from outside agency can log on to the web site (through our load balancer that rewrite client IP as its own IP) and if the external agency uses proxy, it will only report one client IP anyway.

Somehow, I don't see cs_cookie in the extracted field, which could have been helpful.

Any idea what is the best way to approach this?

[dmaislin_splunk]

Use the transaction command:

http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/transaction

sourcetype=webdata | transaction cs_cookie | stats dc(username)

[ashabc]

Thank you for your response.

Does not make a difference. I still get the same result for both commands below.

| stats dc(cs_username)

| transaction cs_Cookie | stats dc(cs_username)

As I mentioned before that there is a likelihood of same cs_username may be used from multiple workstations. How do I catch that?

[ashabc]

Ok, I have managed to get web admin guys to write cookie in IIS log. So, I am seeing a field cs_cookie in the splunk. However, I am not able to relate to unique user with that cookie. It seems that cs_cookie is much more in number compared to cs_username.

Any help will be much appreciated.