Hi, I have a requirement to create dashboards around user activity. Best practice suggests I use summary indexes but I am having no joy. The requirement is to view user activity by day and month. Distinct count of users over a day or month range. Number of days each user logs on per month. Distinct count of users logging on per month in certain ranges. 1-2 days - 236 users 2-8 days - 453 users etc Hits per user per day or month and again distinct count of users per certain Hit ranges. Ability to use the timerange picker to populate the date range in the dashboard. I need to setup the summary index so it contains all past data and indexes the data moving forward. I thought I could just do the below once and schedule it moving forward. index=iis | sistats count by cs_username date | collect index=sumuserdate and run all the searches off that index but the results are odd and also I lose the ability to use the time range picker. For example I can use the below search against the normal index but this results in Splunk going over 60M events index=iis | stats count as Hits dc(date) by cs_username date_month date_year | rangemap field=dc(date) "1"=1-1 "2-11"=2-11 "12-19"=12-19 "20"=20-50 | stats count dc(cs_username) by range date_month date_year Once complete I plan to enrich the users with extra information form a lookup table, geo-location, user rights, business area etc Do I need to add a bucket & span? strptime the date? timechart & span the query? have separate index's for the day and month? I know I'm well off track so any help would be great. ... View more

I have a system that requires authentication so each user has a unique identifier. I have a lookup to enrich users that can return the "Location Country" or "Location Region" or ISO country codes. I would like to plot data against these users actions on the Splunk map. I do not have access to the users IP address. I've looked around for a while but have no idea how to do this, can anyone point me in the right direction? Thanks, Dan Edit: for clarification... is there a way I can take the ISO country codes, or city names and look them up to produce a longitude and latitude, then use that in the maps? It would seem like a trick has been missed if you cant convert ISO country codes this way. ... View more

Hi, I have a request to trend new users on a web application by month over a two year period and produce this report each month. I can get the numbers for each month using the below search.. index=iis earliest=-1mon@mon latest=@mon | search cs_username="PCC*" NOT [search earliest=-24mon@mon latest=-1mon@mon cs_username="PCC*" | dedup cs_username | fields + cs_username] | stats dc(cs_username) by date_month The first problem I have is doing this for each month and presenting it in one chart. The second problem is that due to the date range the search is slow even for the above search that covers new users for the previous month, let alone the entire year by month. What would be the best way to speed this up? Should I run a monthly search which is added to a summary index, and then query the summary index to produce the chart trended over two years? I also have issues with the sub search timing out but I can always adjust the limits.conf using maxtime = X, or is there a better way of doing this? Any advice is much appreciated. Thanks, Dan ... View more

I am looking for some advice around dashboard creation in Splunk. I have created basic test dashboards using Sideview and separate dashboards using the Simple XML inside Splunk. For those experts out there... what would you recommend using to future proof my dashboards? I find Sideview a lot easier to use, however will Splunk eventually bring this functionality to the core product? If so would migration be easy from Sideview back into Splunk? Will Sideview be maintained moving forward? Are there any major advantages / disadvantages between Simple XML and Sideview? Thanks, Dan ... View more

Hi, I use the below query to find published documents and the actions taken against them. sourcetype="iis-2" | extract auto=true | search DocAction NOT DocType="*Research*" NOT [| inputlookup testers_lookup | fields cs_username] NOT cs_username="*HTML*" | fillnull value="-" DocType DocAction publicationId docid DocAut | stats count by DocTitle DocType DocAction publicationId docid DocAut | eval DocType=urldecode(DocType) | eval DocTitle=urldecode(DocTitle) | eval publicationId=urldecode(publicationId) In the field DocAction I have the values =PubInt and =PubExt for when a document is published. Also in the DocAction field I have the value =View for when a document is viewed. The question I want to answer is "What documents are published but do not get viewed in a given time period?" Something like = Return all DocTitle where DocAction ="Pub" and there are no hits against the same DocTitle where DocAction="View" Can anyone help? Thanks, Dan ... View more