Splunk Search

number of user Daily named and anonymous users (last month) and Monthly named and anonymous user (last 6 months)

Path Finder

so I have 4 summary indexes

- source=summary_user
That contains this query:

(host=pnr-proxy-prod* OR host=master*.menlosecurity.com*) source=/var/log/pnr/pnr-enforcement*.log user_id=*
| eval ms_region=rtrim(ms_zone, "abcdefghijklmnop")
| bucket time span=1h
| dedup 1 keepempty=false _time ms_region user_id browser
| eval anon_user_id = if (like(user_id, "anon
%"), user_id, null)
| eval named_user_id = if (NOT like(user_id, "anon_%"), user_id, null)
| table _time ms_region user_id named_user_id, anon_user_id browser, tenant_id
| collect index=summary source=summary_users

- source=summary_daily_users

index=summary source="summary_users"
|stats dc(user_id) as user_id
dc(named_user_id) as named_user_id
dc(anon_user_id) as anon_user_id
by _time, ms_region, tenant_id, browser
|collect index=summary source=summary_daily_users
|sort -num(_time)

- source=summary_monthly_users

index=summary source="summary_users"
|stats dc(user_id) as user_id
dc(named_user_id) as named_user_id
dc(anon_user_id) as anon_user_id
by _time, ms_region, tenant_id
|collect index=summary source=summary_monthly_users
|sort -num(_time)

but its no the result I expect to get for example

01:00 Users (A, B, C) - named_users=3

02:00 Users (A, B, C, D) - named_users=4

03:00 Users (A, C, D) - named_users=3

The "Daily" version of this should report 4 users. The current query will report 10 users.

0 Karma

Motivator

Hey@kiamco,

For source=summary_daily_users
You have splitted it by _time.This will give you hourly count of distinct users,since the summary index used earlier is hourly basis.

You can try running your query like this:

index=summary source="summary_users"
| eval today=relative_time(now(),"@d")
|eval time=strftime(today,"%d/%m/%Y %H:%M:%S")
|stats dc(user_id) as user_id
dc(named_user_id) as named_user_id
dc(anon_user_id) as anon_user_id
by time, ms_region, tenant_id, browser
|collect index=summary source=summary_daily_users
|sort -num(time)

Let me know if this helps!!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!