I believe multikv will be your road to success. Here is a blog post dedicated specifically to grabbing ps output in splunk: http://blogs.splunk.com/2007/08/23/ripping-mulitline-events-at-seach-time/
I think what you'll end up wanting to do is something like the following:
YourPSSearch | multikv filter CriteriaToIdentifyUserSessions | stats count as NumberOfConnectedUsers
Or alternatively, if the filter clause isn't quite powerful enough, you could run a second search afterward. I'd imagine this is slower, though:
YourPSSearch | multikv | search CriteriaToIdentifyUserSessions | stats count as NumberOfConnectedUsers
Hopefully that should get you close to where you want to be.
... View more