Number of current users on a website

You might need to obtain a count of users on a site at a given time when doing the following:

• Managing web server performance

Prerequisites 

In order to execute this procedure in your environment, the following data, services, or apps are required:

• Web server data

Example

Active users provide a real-time measurement of load on the system, which can be helpful in multiple circumstances. If active users are low, for example during the early morning hours, it may be appropriate to proceed with a maintenance activity that could result in downtime or user disruption. Similarly, tracking active users during known peak times helps to gain an appreciation for the use of the system and the impact unexpected degradations can have on the user base. For these reasons, you need a search that can provide active user counts.

NOTE: To optimize the search shown below, you should specify an index and a time range. In addition, this sample search uses Splunk Add-on for Apache Web Server. You can replace this source with any other web server data used in your organization. 

1. Verify you deployed a web server add-on to the search heads, so that the needed tags and fields are defined. For more information, see About installing Splunk add-ons.
2. If you’re using The Splunk Add-on for Apache Web Server, make sure to configure log formatting on the Apache Web Server. For more information, see Configure log formatting on the Apache Web Server using httpd.conf.
3. Choose a critical page on your site to filter on.
4. Run the following search: 

tag=web site=<URL of critical page>
|eval unique_user_info = src_ip.http_user_agent
|timechart span=15m aligntime=now dc(unique_user_info)

Search explanation

The table provides an explanation of what each part of this search achieves. You can adjust this query based on the specifics of your environment.

Result

The search produces a line chart that shows unique users, as described above. It gives a visual of concurrent users over time and visualizes peaks and valleys over time. The timeframe should be selected according to organizational needs. It can be limited to only working hours, business days, or weekends. Concurrent usage is often useful for capacity planning or measuring interest in the content the site presents.