Splunk Search

Splunk query

kajalchopade071
Path Finder

Username status 

User1       login

User2       login

User3       login 

User1     logout 

User1     login

User1    logout 

Now for login user there are 2 count 

And for logout user there are 1 count 

If i have logs Like above i mentioned .

Can you please help me to get the ans which i mentioned  above as per last status of users. 

Labels (7)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

Please be more specific about desired output.

Do you want the last "state" the user is in? (either logged in or logged out)

<your search>
| stats last(status) as status by Username

 And if you want to just count how many users are logged in or out, you might simply add

| stats count by status

at the end.

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Please be more specific about desired output.

Do you want the last "state" the user is in? (either logged in or logged out)

<your search>
| stats last(status) as status by Username

 And if you want to just count how many users are logged in or out, you might simply add

| stats count by status

at the end.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @kajalchopade071,

let me understand, you want to understand if there's a login without logout, is this correct?

If this is your need you have two choices:

  • using transaction command: it's slower but easier to use,
  • using stats command: it's faster but less easy to use and there could be one strange condition.

using transaction, you could use something like this:

index=your_index
| transaction Username startswith=status=login endswith=status=logout keepevicted=true
| eval Status=if(closed_txn=0,"Login and Logout","Only Login")
| table Username Status duration

using stats it's difficoult to calculat duration when one Username can have more logins; anyway, you could use:

index=your_index
| stats dc(status) AS dc_status count(eval(status="Login")) AS logins count(eval(status="Logout")) AS logouts earliest(_time) AS earliest latest(_time) AS latest BY Username
| eval Status=if(dc_status=1 OR logins>logouts,"Only Login","Login and Logout", duration=latest-earliest
| table Username Status duration

 Ciao.

Giuseppe

0 Karma

kajalchopade071
Path Finder

As per the users last status i need to count the login users and logout users 

 

0 Karma

kajalchopade071
Path Finder

We need to find out the count for login user and logout user. As per the user last status like login OR logout. If the user last status is logout it counts in logout user. If user last status is login it Will be count in login users. In above question i mentioned some ex of  logs in that user1 last status is logout it needs to count in logout user. 

0 Karma

SinghK
Builder

Index = your index l dedup Username | stats count by Username 

Please try this..

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...