Using tstats to generate list of unique users logged in over time

[jmaple]

I'm trying to create a simple report that shows the number of unique users logged into our Cisco ASA over the course of time. One report would be 24 hours and the other would be 30 days. tstats comes to mind when I want to create my search so my report doesn't take an hour to complete but it seems I can't get a result despite the many formats I try the command. Here is what I figured would work:

|tstats dc(user) WHERE sourcetype=cisco:asa BY _time span=1h

I get a simple table but the counts don't seem to show. Where am I going wrong?

[javiergn]

Hi,

Unless user is an indexed field, you won't be able to use tstats against it.
See this.

If that's your case you have some alternatives:

• Create an indexed field for your the user field (note this won't help with old data).
• Create a summary index for the data you are trying to report on and use that simplified index instead
• If you are using Enterprise Security and your Cisco ASA logs are CIM normalised, you should be able to use one of the existing datamodels to filter by sourcetype cisco:asa and pivot by users.
• Quick and easy but not as accurate => If you just care about unique users and don't mind not being 100% accurate, you can also use Event Sampling (1:100 should do) and simply run something like:

Unique users over time (remember to enable Event Sampling)

index=yourciscoindex sourcetype=cisco:asa
| stats count by user
| fields - count

[sundareshr]

tstats command works on indexed fields in tsidx files. The indexed fields can be from normal index data, tscollect data, or accelerated data models. By default, the user field will not be an indexed field, it is usually extracted at search time. To overcome this, you could create an accelerated data model (which will create a tsidx file) and run your tstats commend on that.

| tstats dc(datamodelname.user) FROM datamodel=datamodelname BY _time span=1h

[somesoni2]

The tstats command only works with indexed fields (metadata fields likes _time source/sourcetype/host/index and fields added with index-time field extraction). It seems your user field in not one of them.

If you can't setup your user field as index-time field extraction, consider using summary indexing for your report.

Update

I stand corrected and now Including data models also into the picture. The tstats works on data models as well as data model fields are indexed (stored in tsidx file on indexer).