Splunk Search

IIS log user count

ashabc
Contributor

My purpose is to count currently logged in user for a web site

Easiest way to get this is something like | stats dc(cs_username)

However, that really does not reflect true numbers that I am after as there could be one username logged in from different client machines simultaneously. Also, it is possible that users from outside agency can log on to the web site (through our load balancer that rewrite client IP as its own IP) and if the external agency uses proxy, it will only report one client IP anyway.

Somehow, I don't see cs_cookie in the extracted field, which could have been helpful.

Any idea what is the best way to approach this?

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee

Use the transaction command:

http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/transaction

sourcetype=webdata | transaction cs_cookie | stats dc(username)

0 Karma

ashabc
Contributor

Thank you for your response.

Does not make a difference. I still get the same result for both commands below.

| stats dc(cs_username)

| transaction cs_Cookie | stats dc(cs_username)

As I mentioned before that there is a likelihood of same cs_username may be used from multiple workstations. How do I catch that?

0 Karma

ashabc
Contributor

Ok, I have managed to get web admin guys to write cookie in IIS log. So, I am seeing a field cs_cookie in the splunk. However, I am not able to relate to unique user with that cookie. It seems that cs_cookie is much more in number compared to cs_username.

Any help will be much appreciated.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...