Splunk Search

number of user Daily named and anonymous users (last month) and Monthly named and anonymous user (last 6 months)

kiamco
Path Finder

so I have 4 summary indexes

- source=summary_user
That contains this query:

(host=pnr-proxy-prod* OR host=master*.menlosecurity.com*) source=/var/log/pnr/pnr-enforcement*.log user_id=*
| eval ms_region=rtrim(ms_zone, "abcdefghijklmnop")
| bucket time span=1h
| dedup 1 keepempty=false _time ms_region user_id browser
| eval anon_user_id = if (like(user_id, "anon
%"), user_id, null)
| eval named_user_id = if (NOT like(user_id, "anon_%"), user_id, null)
| table _time ms_region user_id named_user_id, anon_user_id browser, tenant_id
| collect index=summary source=summary_users

- source=summary_daily_users

index=summary source="summary_users"
|stats dc(user_id) as user_id
dc(named_user_id) as named_user_id
dc(anon_user_id) as anon_user_id
by _time, ms_region, tenant_id, browser
|collect index=summary source=summary_daily_users
|sort -num(_time)

- source=summary_monthly_users

index=summary source="summary_users"
|stats dc(user_id) as user_id
dc(named_user_id) as named_user_id
dc(anon_user_id) as anon_user_id
by _time, ms_region, tenant_id
|collect index=summary source=summary_monthly_users
|sort -num(_time)

but its no the result I expect to get for example

01:00 Users (A, B, C) - named_users=3

02:00 Users (A, B, C, D) - named_users=4

03:00 Users (A, C, D) - named_users=3

The "Daily" version of this should report 4 users. The current query will report 10 users.

0 Karma

deepashri_123
Motivator

Hey@kiamco,

For source=summary_daily_users
You have splitted it by _time.This will give you hourly count of distinct users,since the summary index used earlier is hourly basis.

You can try running your query like this:

index=summary source="summary_users"
| eval today=relative_time(now(),"@d")
|eval time=strftime(today,"%d/%m/%Y %H:%M:%S")
|stats dc(user_id) as user_id
dc(named_user_id) as named_user_id
dc(anon_user_id) as anon_user_id
by time, ms_region, tenant_id, browser
|collect index=summary source=summary_daily_users
|sort -num(time)

Let me know if this helps!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...