I'm trying to create a simple report that shows the number of unique users logged into our Cisco ASA over the course of time. One report would be 24 hours and the other would be 30 days. tstats comes to mind when I want to create my search so my report doesn't take an hour to complete but it seems I can't get a result despite the many formats I try the command. Here is what I figured would work:
|tstats dc(user) WHERE sourcetype=cisco:asa BY _time span=1h
I get a simple table but the counts don't seem to show. Where am I going wrong?
The tstats command only works with indexed fields (metadata fields likes _time source/sourcetype/host/index and fields added with index-time field extraction). It seems your user field in not one of them.
If you can't setup your user field as index-time field extraction, consider using summary indexing for your report.
I stand corrected and now Including data models also into the picture. The tstats works on data models as well as data model fields are indexed (stored in tsidx file on indexer).
tstats command works on indexed fields in tsidx files. The indexed fields can be from normal index data, tscollect data, or accelerated data models. By default, the
user field will not be an indexed field, it is usually extracted at search time. To overcome this, you could create an accelerated data model (which will create a tsidx file) and run your
tstats commend on that.
| tstats dc(datamodelname.user) FROM datamodel=datamodelname BY _time span=1h
Unless user is an indexed field, you won't be able to use tstats against it.
If that's your case you have some alternatives:
index=yourciscoindex sourcetype=cisco:asa | stats count by user | fields - count