In a search head cluster, how do I search users that have logged in the last 30 minutes, on what cluster member, and what kind of searches they are running?

[ronak]

What setup is required and what will be the search so that I can find out,

1. Who all have logged in to the system in the last 30 minutes
2. what kind of searches they are running
3. which search head (I've three in my cluster) these users were connected/logged in to

thanks, ronak

[GDustin]

splunk_webaccess -> splunk_ui_access

logged in users
index=_internal sourcetype=splunkd_ui_access | dedup host user | table host user _time req_time
logged in users rolling time

index=_internal sourcetype=splunkd_ui_access | table host user _time req_time

[sk314]

If you have an indexer cluster -> You should have all this info in the Distributed Management Console on the Cluster Master.

[GDustin]

where it that in DMC?

[pradeepkumarg]

Start here

For users logged in, and search head they are in

index=_internal sourcetype=splunk_webaccess | dedup host USER | table host USER 

For the searches issued..

index=_internal sourcetype=splunkd_remote_searches

Cross check the sourcetypes for the exact naming..

[mendesjo]

sourcetype of splunk_webaccess at least in 6.3.3 version isn't available..

[GDustin]

verified 6.5.3
index=_internal sourcetype=splunkd_ui_access | dedup host user | table host user _time req_time