topic Re: How do you find out who is logged onto Splunk right now? in Security

How do you find out who is logged onto Splunk right now?

dhaffner — Fri, 18 Jun 2010 03:18:39 GMT

I'm trying to find a way to see, at any given point in time, what users are actually logged into Splunk. (At least how many) Does anyone have any suggestions? Thanks!

Re: How do you find out who is logged onto Splunk right now?

Stephen_Sorkin — Fri, 18 Jun 2010 03:54:13 GMT

You can check the HTTP auth tokens endpoint to see the session keys that are valid and can be used to access splunkd.

https://splunk-server:8089/services/admin/httpauth-tokens

Re: How do you find out who is logged onto Splunk right now?

Lowell — Fri, 18 Jun 2010 04:48:41 GMT

You can also get some information by searching some internal splunk logs:

Based on web access to splunkd web (ip address only)

index=_internal source="*web_access.log" earliest=-15m | top clientip
User based on interactive searches:

index=_internal source=searches | top user
User logins based on audit logs:

index=_audit action="login attempt" "info=succeeded"

There doesn't seem to be any audit of any logout events, unfortunately.

Re: How do you find out who is logged onto Splunk right now?

rotten — Fri, 18 Jun 2010 20:48:11 GMT

Under the 'status' dropdown in the Search app (if you are using 4.1+), you can slide out the 'Search Activity' submenu, and select "UI Activity". This shows you people who are accessing splunk via the web interface.

It doesn't really show you if they are actually doing something at that very moment, but you can narrow your list of people whom you need to call before doing maintenance...

Re: How do you find out who is logged onto Splunk right now?

mzorzi — Thu, 27 Jan 2011 20:30:46 GMT

You can find logout message in web_service.log

2010-06-27 04:21:40,855 INFO [4d416354d820e7f350] account:237 - user=matt action=logout status=success reason=user-initiated useragent="Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5" clientip=101.33.11.153

Re: How do you find out who is logged onto Splunk right now?

Ovi — Mon, 28 Sep 2020 12:45:31 GMT

How about this?
Seems to work for me and aside from users currently logged-in, tracks also the times when a user logged-in or logged-off:

index=_internal source="*web_access.log" user!="-" |eval status=if(count < 1,0,1)| timechart max(status) by user

Re: How do you find out who is logged onto Splunk right now?

I_am_Jeff — Fri, 09 Nov 2012 21:30:55 GMT

Kinda neat. It gets a cumbersome if more than a few users are logged in or searching over a long time period, but I like it. If you just want to count users change "timechart" to "stats".

Re: How do you find out who is logged onto Splunk right now?

dmillis — Mon, 28 Sep 2020 13:40:38 GMT

Another alternative to show who has logged in during the last hour and is still logged in now:
index=_internal (action=login OR action=logout) sourcetype="splunk_web_service" earliest=-1h | stats first(action) as currentstate by user | where currentstate="login"

Re: How do you find out who is logged onto Splunk right now?

kurdbahr — Tue, 30 Jul 2013 08:54:13 GMT

Using the same interface in a Splunk search:

| rest /services/authentication/httpauth-tokens splunk_server=local | stats max(updated) by userName

Re: How do you find out who is logged onto Splunk right now?

Leo — Sat, 22 Mar 2014 22:14:13 GMT

I've put together an app that shows in real time who's logged on: Who's there
Please let me know if you have any suggestions.

Re: How do you find out who is logged onto Splunk right now?

ITICSNORTH — Tue, 23 Sep 2014 10:29:26 GMT

perfect man it works 🙂

Re: How do you find out who is logged onto Splunk right now?

koshyk — Wed, 26 Nov 2014 10:58:38 GMT

nice one. variety one.
Based on this the timechart looks very good and stacked one quite cool. cheers for this

Re: How do you find out who is logged onto Splunk right now?

theunf — Sun, 07 Jun 2015 06:55:05 GMT

Leo,

I use almost the same way you did to build your APP.
Does it compatible with SHC ?

I´m very much concerned about how disk consumption is growing with the artifacts replication in a SHC environment.

Below is a list of dashs I´m trying to get done usin my spare time :
- individual disk usage (searchable UI) and top disk usage users
- alert on artifacs with an expiration time of X hours and more than X MBs
- SHC artifacs replication and configuration sync status among Search Heads
- per search head total disk usage historical usage curve and a "prediction" of how much disk will be needed in X months/days
- alert for a threshold on free disk space X growth percentage

Take these as a suggestion to be added to your app or point me out any APPs that maybe
already accomplishing doing at least part of it.

Cya.

Re: How do you find out who is logged onto Splunk right now?

deepan1n1 — Fri, 14 Aug 2015 11:03:14 GMT

How about pulling out the host/ip from which the user is accessing Splunk ?

Re: How do you find out who is logged onto Splunk right now?

robertlynch2020 — Fri, 04 Nov 2016 10:54:59 GMT

index=_audit action="login attempt" "info=succeeded" | stats count by action , user , _time | timechart span=1d count by user

I used this

Re: How do you find out who is logged onto Splunk right now?

lakromani — Sat, 05 Nov 2016 15:57:17 GMT

I did like this as well.
But is there an easy way to get row as user and column as time?
If I do:

index=_internal source="*web_access.log" user!="-" 
| eval status=if(count < 1,0,1)
| timechart max(status) by user 
| transpose

Its close to correct, except column header becomes row1 row2 etc, not the time?
How to fix that?

Re: How do you find out who is logged onto Splunk right now?

robertlynch2020 — Tue, 29 Sep 2020 11:59:45 GMT

index=_internal sourcetype=splunkd_ui_access | stats count by clientip , user , _time | lookup dnslookup clientip | timechart distinct_count(clienthost) by clienthost span=1d limit=100

This command worked very well