Dashboards & Visualizations

Struggling with rex - Need to build a dashboard of concurrent users

pramsey
New Member

Every hour, we have a group of devices that send out a similar log:

Feb 16 03:01:00 DeviceNameA.domain.com 2014-02-16 03:01:00 - DeviceNameA - [127.0.0.1] System()[] - Number of concurrent users logged in to the device: 35

Feb 16 03:01:00 DeviceNameB.domain.com 2014-02-16 03:01:00 - DeviceNameB - [127.0.0.1] System()[] - Number of concurrent users logged in to the device: 68

Feb 16 03:01:00 DeviceNameC.domain.com 2014-02-16 03:01:00 - DeviceNameC - [127.0.0.1] System()[] - Number of concurrent users logged in to the device: 170

My goal is to build a dashboard that lists all the devices and how many users are currently logged in (for the past hour), then add all 24 hours up for the past day, then add all the days up for the past week, then all the weeks up for the past month, etc...

Brand new to splunk. I think what I am trying to do is turn the string of text "Number of concurrent users logged in to the device:" into a field and then I will be able run a report on that field, then add that report to a dashboard.

After a few hours of muddeling through the field extraction tool, I never got the expected result in the tool, but I was able to generate a query based on the regex it gave me. see below.

"concurrent users logged in to the device" | rex field=_raw "search.(?i)^(?:[^-]*-){9}\s+(?P\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+\s+\w+:)"

Does this mean I now have a field called ConcurrentUsers in this particular query? When I run the query, splunk highlights "concurrent users logged in to the device" like I would expect and does not return an error. Now what? 🙂

Tags (3)
0 Karma

yannK
Splunk Employee
Splunk Employee

Here is a lighter version of the regex, you can use it to create an automatic field extraction, or keep the rex command.

"Number of concurrent users logged in to the device: (<concurrentusers>\d+)"

Do the same for the device name. Then you can check the evolution over the time with a search like. Using the max and average a good way.

source=mysource | timechart span=1h max(concurrentusers) by device

Then if you want to show last our, then previous days average, check those techniques :

0 Karma

pramsey
New Member

Hi yannK, thanks for the response. I am not sure I am following though. I tried different iterations of what you have with various errors. Can you put in the entire query you would run in order to produce the expected results?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...