Hello,
I want to get a total count of current active Citrix users as well as get an average and max for the day. I would also like to do this with Total active users using the Remote Connections app. I would like to plug these searches into a Remote Workforce Insights dashboard we are putting together. Haven't been able to figure out how to do this so any ideas help.
Thanks,
Cooper J
Hi Cooper,
Did you see our Session Overview dashboard? A lot is covered there.
ICA sessions per day:
| pivot `uA_DM_Session_SessionDetail_Users` Session_SessionDetail_Users
dc(SessionGUID) as UniqueSessions
splitrow
_time
period day
filter SessionProtocol in (ICA)
How would I get the avg and max for the day for the Total Citrix Sessions as well as get the total amount of active users for people using the Remote Desktop Connections app?
Hi Cooper,
Max sessions
For max Citrix session have a look at the screenshot above. It's Max. concurrent sessions in the panel Totals for all sessions.
Average session
As for the average. What should be your baseline for the average? Average sessions per server? Mathematically, there can't be an average of a single total value. A single average value is in your case not very meaningful. Instead, you probably want to look at the average over a certain period of time.
Active users of the remote desktop connections app
| pivot `uA_DM_Application_ApplicationUsage` Application_ApplicationUsage
dc(UserName) as "# Users"
splitrow
AppName as App
splitrow
AppVersion as Version
filter AppName is "Remote Desktop Connections app"
Hello Dominik,
I appreciate your assistance with this. I would like to get an average of Total users signed in on Citrix by hour for work hours only. I would also like to get an average for remote desktop connections as well. Is this possible?
Thanks,
Cooper J
Hi Cooper,
Sure. We have to go with a normal SPL search instead of pivot though.
index=uberagent sourcetype="uberAgent:Session:SessionDetail" SessionProtocol=ICA earliest=-w latest=now
| eval hour = tonumber(strftime(_time,"%H"))
| eval dow = tonumber(strftime(_time,"%w"))
| where hour>=9 AND hour<=17 AND dow!=0 AND dow!=6
| timechart span=1h dc(SessionUser) as "# Citrix users"
The magic happens in that line:
| where hour>=9 AND hour<=17 AND dow!=0 AND dow!=6
There, we are filtering for events from 9 AM to 5 PM and excluding Saturdays as well as Sundays.
If you change SessionProtocol=ICA in thefirst line to SessionProtocol=RDP you search for RDP sessions.