Hi
I have the below command that i think works 95% of the time.
index=_internal sourcetype=splunkd_ui_access | stats count by clientip , user , _time | lookup dnslookup clientip | timechart span=1d distinct_count(clienthost) by clienthost limit=100
The issues is sometime is reports users that did not use the system. I think this might be because of IP address changing. However i am not 100% about this.
Any help would be brill.
Hi,
The issues is sometime is reports users that did not use the system. I think this might be because of IP address changing. However i am not 100% about this.
This doesn't sound right... how should splunk know about the names of other users that didn't access the instance??
Hi robertlynch2020,
surely IP address changes because is assigned by a dns.
Anyway you could create a lookup with a list of all users.
You could maintain this lookup with a scheduled search or an extraction from Active Directory.
If you have this lookup you can check the users in your search and list the ones not present:
index=_internal sourcetype=splunkd_ui_access
| eval user=lower(user)
| stats count BY user
| append [ | inputlookup user_lookup.csv | eval user=lower(user), count=0 | fields user count ]
| stats sum(count) AS Total by user
In this way users with Total=0 are missed and users with Total greater than 0 are present.
Bye.
Giuseppe