How many external Users

3 comments

• 0
  
  Dominik Britz May 10, 2023 07:37

  Hi David,

  You can see from where sessions have connected in the Citrix Session Configuration Details dashboard in the chart Sessions connected via. In case it went through a NetScaler, you'd see the SNIP there.

  

  uberAgent is reporting the data in the field NetworkConnectedVia.

  Best regards

  Dominik

   

• 0
  
  David Hübscher May 10, 2023 11:50

  Hi Dominik 

  Thanks for the info. But then I have to go throug each session. I would like to have an export from a user session overview with only external Users. But there I can't see the "connectedvia".

  Regards
  David

• 0
  
  Dominik Britz May 10, 2023 12:25

  That is not possible with the built-in dashboards, I'm afraid. You would need to create a new dashboard with custom searches or copy ours and modify all searches. 

  As an example, I took the chart CPU time per session (top 10) of the User Sessions dashboard and extended it with a filter for sessions connected via the SNIPs 10.1.1.21 and 10.1.1.22. I used Splunk's join command to achieve that result.

   

  | pivot `uA_DM_Session_SessionDetail_Users` Session_SessionDetail_Users
      sum(SessionCPUTimeS) as "sum(SessionCPUTimeS)"
      sum(SessionIOCount) as "sum(SessionIOCount)"
      avg(SessionWorkingSetMB) as "avg(SessionWorkingSetMB)"
      max(SessionRpLatencyMs) as "max(SessionRpLatencyMs)"
      latest(SessionUserLower) as SessionUser
      latest(host) as Host
      splitrow
         SessionGUID 
  | join type=inner SessionGUID 
      [| pivot `uA_DM_CitrixSession_SessionConfig` CitrixSession_SessionConfig
          latest(NetworkConnectedVia) as NetworkConnectedVia
          splitrow
             SessionGUID
          filter NetworkConnectedVia in ("10.1.1.21","10.1.1.22") 
       | fields + SessionGUID NetworkConnectedVia
      ] 
  | eval "User@host"=replace(SessionUser,"([^\\\\]+\\\\)([^\\\\]+)","\\2")+"@"+Host 
  | sort limit=10 - "sum(SessionCPUTimeS)" 
  | fields
      "User@host"
      "sum(SessionCPUTimeS)"
      SessionGUID
      NetworkConnectedVia