how to get the number of logins per user for the past 30 days?

[kiran_mh]

We want to know how to get the number of logins per user for the past 30 days? and also, if there is a metric we can see how long users are logged into the system .

[teunlaan · Accepted solution]

number of logins : index=_audit info=succeeded action="login attempt" | stats count by user

How many hours someone someone is accessing is very hard to get (in my opinion)
You could calculate the time between login and logout times. BUT most users don't press the logout button, so you don't have the data.

So you should track when users fires searches.

[richgalloway]

Logins to what? Which system?

[kiran_mh]

how to get the number of logins per user for the past 30 days
in splunk
also, if there is a metric we can see how long users are logged into the splunk

We also need to know how much hours a user is accessing splunk per day