Long-term trends in web server user load

You might want to track unique users accessing a site over time when doing the following:

• Managing web server performance

Prerequisites 

In order to execute this procedure in your environment, you may need to first on-board the data, services, or apps shown in the following table.

Example

The purpose of this example is to show how this procedure works in a general environment. In your environment, you can optimize the search by specifying an index, a time range, or a different data source. 

Long-term trending of user load provides a strong indication of usage and adoption trends for the site. When long-term user load is correlated with resource consumption like cpu, disk, and memory usage, the resulting data can help with capacity planning where usage and adoption is expected to continuously increase. Alternatively, in cases where usage and adoption is expected to increase, but does not, it could be an indicator of a failed marketing campaign, a problematic onboarding or customer experience problem, or a similar problem. For these reasons, you need a search that will enable you to see these trends in user load.

1. Verify you deployed the add-on (either for Apache Web Server or for Microsoft IIS) to the search heads, so that the needed tags and fields are defined. For more information, see About installing Splunk add-ons.
2. Choose a specific site you want to measure usage and adoption trends on.
3. Run the following search: 

tag=web site=<URL of critical site>
|eval unique_user_info = src_ip.http_user_agent
|timechart span=15m dc(unique_user_info) AS unique_users

Search Explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Result

If, over time, the data show an increase in the number of unique users, you might want to show response times on the same dashboard so that capacity planning or optimization decisions can be made and mitigation planned.