Splunk search for Unique Splunk logons per day
Copy
index=_audit info=succeeded | timechart span=1d dc(user) as "Unique Users" count(user) as "Total Logins"
This search will help to identify how frequently Splunk is being used. The search will output a count of unique users that have successfully logged into Splunk within the given search window.
0 comments
[0]
[0]
[0]
[0]
Sign in or Register to submit a comment