Metrics
The Metrics section (route /metrics-top-users and /metrics-active-users) aggregates your organisation’s usage data into two read-only reports: Top Users and Active Users. They are the analytical view of the same event stream that powers the audit screens, summarised so you can see who uses the platform most and how adoption changes over time.
Purpose
Metrics turn raw audit events into usable summaries. The Top Users report ranks end users by the number of sessions they generated within a time window, and the Active Users report shows how many unique users were active in each time interval across that same window. Both screens sit beside the searchable records described in Audit and diagnostics and the sign-in events in Authentication audit, but they answer a different question: not what happened but how much is happening and from whom.
Why use it
- Identify your heaviest platform users, by number of sessions, for licence planning and support triage.
- Track platform adoption: whether the number of active users per day or per week is growing or shrinking.
- Filter usage by a specific resource (application, database, desktop, share, SSH target and so on) to understand which assets are used most.
- Export the reports to CSV for capacity planning, chargeback, or compliance reporting.
- Support the usage picture that appears in Billing and subscriptions, where peak usage can affect your bill.
When to use it
- During quarterly or monthly reviews of who is actually using the platform.
- Before renewing licences or planning capacity, to see whether current seats are sufficient.
- When a user complains about performance, to check whether they are a heavy user of a shared resource.
- When onboarding a new site, to confirm that its users are becoming active.
Prerequisites: the metrics reports require both a metrics viewer role and application read or admin permission. Without them the menu items are disabled and the pages show a no permissions message. An owner or administrator can grant the permissions needed.
How to use it
Open Metrics in the left navigation and choose Top Users or Active Users.
Both reports share the same workflow:
- Choose a start time and end time with the date pickers, or leave them empty to use the default window of the previous 30 days.
- Optionally restrict the report to a resource name (an application or resource, chosen from the autocomplete list) and a resource type (for example application, database, desktop or SSH).
- Select VIEW METRICS to run the report. On the Top Users screen the report area is empty until you do; Active Users loads automatically with the default window.
- Read the bar chart and the table below it.
- Select DOWNLOAD to export the current results as a CSV file.
The page header includes a Product Guide link that opens the matching section of the web guide (#h-top-users or #h-active-users).
Interpreting Top Users
The Top Users screen shows a vertical bar chart titled Number of Sessions for Top 500 Users and a table with the columns User and # Sessions. Each bar is one end user’s email address and the bar height is the number of sessions that user generated in the chosen window. The report fetches the top 500 users by session count; the chart and the table plot the top 30 individually and group the remainder into a single Remainder category so the view stays readable. The CSV download contains all returned users, not just the top 30.
Interpreting Active Users
The Active Users screen shows a bar chart titled Number of Unique Active Users per Time Interval and a table with the columns time and Active Users. The interval is chosen automatically from the width of your date range:
| Range width | Interval shown |
|---|---|
| Fewer than 3 days | Hourly |
| 3 to 10 days | Every 4 hours |
| More than 10 days | Daily |
The value in each bucket is the number of unique users active in that interval. If your chosen window cuts across a bucket boundary, hovering over the bar shows a warning that the displayed value may be based on partial data, because the whole bucket is not included in the time range.
%%{init: {"theme": "base", "themeVariables": {"background": "#ffffff", "primaryColor": "#e8f1fb", "primaryBorderColor": "#1f4e79", "primaryTextColor": "#111111", "lineColor": "#4a4a4a", "secondaryColor": "#f5f5f5", "fontFamily": "Inter, sans-serif"}} }%%
flowchart LR
AUD[Audit events: authentication, authorisation, resource activity] --> AGG[Metrics aggregation]
AGG --> TOP[Top Users: sessions per user]
AGG --> ACT[Active Users: unique users per interval]
TOP --> BI[Billing and subscriptions: peak usage]
Fields and controls reference
Both metrics screens share the same filter controls.
| Field or control | Purpose | Required | Default | Valid values | Notes |
|---|---|---|---|---|---|
| Start Time | Start of the reporting window | No | 30 days before today | A date and time up to today | Opens an Owl date-time picker; the end time cannot be before it |
| End Time | End of the reporting window | No | Today | A date and time up to today | The start time cannot be after it |
| Resource name | Restrict the report to one application or resource | No | None | Any application or resource in the autocomplete list | Combines application and resource names |
| Resource type | Restrict the report to a resource category | No | Any | application, applicationaccess, applicationservice, database, desktop, fileshareaccess, fileshare, group, ip, launcher, service_forwarder, ssh | |
| VIEW METRICS | Runs the report for the current filters | n/a | n/a | n/a | Loads the chart and table |
| DOWNLOAD | Exports the current report as CSV | n/a | n/a | n/a | Top Users produces topusers.csv; Active Users produces activeusers.csv |
Top Users table columns
| Column | Meaning |
|---|---|
| User | The end user’s email address |
| # Sessions | The number of sessions the user generated in the window |
When more than 30 users are returned, the table ends with a Remainder row whose count is the sum of the remaining users’ sessions. The CSV download contains every returned user individually.
Active Users table columns
| Column | Meaning |
|---|---|
| time | The start of the time bucket, as an ISO timestamp |
| Active Users | The number of unique active users in that bucket |
Dialogs and popups
There are no configuration dialogs on the metrics screens. The date pickers open over the page, and the Active Users chart shows a tooltip when you hover over a bar. There are no other popups.
Configuration versus diagnostics versus confirmation
- Configuration: none. These screens never change settings; they only read aggregated usage data.
- Diagnostics: the entire section is diagnostic. Both reports are read-only summaries of the audit stream.
- Confirmation: none. There are no destructive actions. The DOWNLOAD button creates a file in your browser’s download location.
Pagination and async behaviour
- The results table pages at 25 rows per page. The paginator shows the total (for example 1 to 25 of 31); use the arrow buttons or a page number to move through the results. There is no pagination on the bar chart itself.
- Results load asynchronously. On the Top Users screen, the report area can be empty after navigation; select VIEW METRICS to load the data for the current window. Filtering by resource name or resource type also takes effect when you select VIEW METRICS.
- The notifications badge in the top bar is independent of these reports; it shows unread inbox messages (see News and notifications).
Troubleshooting
- The Top Users report is empty after navigation: select VIEW METRICS. The report does not reliably auto-load on first visit, but always loads when you run it explicitly.
- A filtered report shows no rows: the chosen resource or resource type has no recorded sessions in the window. Widen the date range or clear the resource filters.
- Active Users shows only zeroes: this is expected when no users were active in the interval, for example in a quiet test organisation or outside working hours. Shorten the window to see hourly buckets.
- A bar shows a partial-data warning: the window cuts across the start or end of a bucket, so the value may understate activity. Extend the window so it covers whole buckets, or start the window at a bucket boundary (midnight UTC for daily buckets).
- The CSV is empty: run VIEW METRICS first; the download reflects the currently loaded report.