0

Tie an Internet Explorer URL to a user session

Is there a way to tie Browser Performance: Internet Explorer to a user session in a mutliuser environment?

2 comments

  • Avatar
    Timm Brochhaus Official comment

    Information about the user is not part of uberAgent's dataset Application_BrowserPerformanceIE by default.

    But the dataset includes the host as well as the process id of the running Internet Explorer instance, so you can correlate this information with the dataset Process_ProcessDetail to get the username also. 

    Here is an example of a custom Splunk search:

    | pivot uberAgent Application_BrowserPerformanceIE
    sum(CPUTimeS) AS SumCPUTimeS
    avg(CPUPercent) AS FuncCPUPercent
    splitrow
    URLHost as "URL host"
    splitrow
    host
    splitrow
    ProcID
    filter host in (*)
    filter URLHost in (*)
    filter URL isNot "none"
    | eval "Total CPU time (s)"=round(SumCPUTimeS,1)
    | eval "Avg. CPU (%)"=round(FuncCPUPercent,1)
    | join type=outer ProcID host
    [
    | pivot uberAgent Process_ProcessDetail
    values(User) as ProcUser
    splitrow
    host
    splitrow
    ProcID
    filter ProcName is "iexplore.exe"
    | fields +
    host
    ProcID
    ProcUser
    ]
    | table
    host
    ProcUser
    "URL host"
    "Total CPU time (s)"
    "Avg. CPU (%)"
    | sort limit=0 - "Avg. CPU (%)"

     

  • 0
    Avatar
    Michael McGuinness

    This worked like a champ, thanks so much!

Please sign in to leave a comment.