How to do it...

Follow the steps in this recipe to leverage report acceleration to display the maximum number of concurrent sessions over time:

  1. Log in to your Splunk server.
  2. Select the Operational Intelligence application.
  1. From the search bar, enter the following search and select to run over Last 7 days:
index=main sourcetype=log4j | timechart span=1m dc(sessionId) AS concurrent_sessions | timechart span=30m max(concurrent_sessions) AS  max_concurrent_sessions
  1. You might find that the search takes about 2-3 minutes to run if you have 7 days of generated data. Splunk should now display the results of the search, similar to the results shown here:
  1. Click on the Save As dropdown and select Report from the list:
  1. In the pop-up box that ...

Get Improving Your Splunk Skills now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.