Number of current users on a website

You might need to obtain a count of users on a site at a given time when doing the following:

• Managing web server performance

Prerequisites 

In order to execute this procedure in your environment, you may need to first on-board the data, services, or apps shown in the following table.

Example

The purpose of this example is to show how this procedure works in a general environment. In your environment, you can optimize the search by specifying an index, a time range, or a different data source. 

Active users provide a real-time measurement of load on the system, which can be helpful in multiple circumstances. If active users are low, for example during the early morning hours, it may be appropriate to proceed with a maintenance activity that could result in downtime or user disruption. Similarly, tracking active users during known peak times helps to gain an appreciation for the use of the system and the impact unexpected degradations can have on the user base. For these reasons, you need a search that can provide active user counts.

1. Verify you deployed the add-on (either for Apache Web Server or for Microsoft IIS) to the search heads, so that the needed tags and fields are defined. For more information, see About installing Splunk add-ons.
2. If you’re using The Splunk Add-on for Apache Web Server, make sure to configure log formatting on the Apache Web Server. For more information, see Configure log formatting on the Apache Web Server using httpd.conf.
3. Choose a critical page on your site to filter on.
4. Run the following search: 

tag=web site=<URL of critical page>
|eval unique_user_info = src_ip.http_user_agent
|timechart span=15m aligntime=now dc(unique_user_info)

Search Explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Result

The search produces a line chart that shows unique users, as described above. It gives a visual of concurrent users over time and visualizes peaks and valleys over time. The timeframe should be selected according to organizational needs. It can be limited to only working hours, business days, or weekends. Concurrent usage is often useful for capacity planning or measuring interest in the content the site presents.