https://community.splunk.com/t5/Splunk-Enterprise/How-to-find-out-if-a-user-logged-in-as-quot-guest-quot-and-then/m-p/283434#M597 <P>Suggest using the latest version of the doc <A href="http://docs.splunk.com/Documentation/Splunk/6.4.0/Troubleshooting/WhatSplunklogsaboutitself">What Splunk logs about itself</A></P> Tue, 05 Apr 2016 18:26:53 GMT dkoshe_splunk 2016-04-05T18:26:53Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-find-out-if-a-user-logged-in-as-quot-guest-quot-and-then/m-p/283428#M591 <P>Hey all. Just trying to find a way to see if a user logs in on "guest", and then switches to an account with admin privileges? Any help would be greatly appreciated! Thanks!</P> Tue, 05 Apr 2016 02:28:06 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-find-out-if-a-user-logged-in-as-quot-guest-quot-and-then/m-p/283428#M591 steinr23 2016-04-05T02:28:06Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-find-out-if-a-user-logged-in-as-quot-guest-quot-and-then/m-p/283429#M592 <P>Assuming by "switches" you mean "logs out of the 1st session &amp; logs in again using a different account", that would be pretty difficult to do w/certainty. If you are indexing network traffic &amp; can ascertain that the admin logged in from the same ip that the non-admin just logged out from, that would be a good indication but who's to say the source ip system was not shared? Splunk provides a very flexible logging system that provides quite a bit of granularity w/regards to how much info is logged but determining who was sitting at a particular keyboard is going to be tough. Another approach might be to correlate "guest" activity w/the admin activity: if the guest was looking at a particular alert, for instance &amp; then an admin logged in and modified that same alert then that's significant.</P> Tue, 05 Apr 2016 17:13:43 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-find-out-if-a-user-logged-in-as-quot-guest-quot-and-then/m-p/283429#M592 jterry 2016-04-05T17:13:43Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-find-out-if-a-user-logged-in-as-quot-guest-quot-and-then/m-p/283430#M593 <P>Logs onto what? Splunk? the OS?</P> Tue, 05 Apr 2016 17:50:51 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-find-out-if-a-user-logged-in-as-quot-guest-quot-and-then/m-p/283430#M593 lguinn2 2016-04-05T17:50:51Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-find-out-if-a-user-logged-in-as-quot-guest-quot-and-then/m-p/283431#M594 <P>whichever. i'd assume the context of the original question</P> Tue, 05 Apr 2016 17:53:36 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-find-out-if-a-user-logged-in-as-quot-guest-quot-and-then/m-p/283431#M594 jterry 2016-04-05T17:53:36Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-find-out-if-a-user-logged-in-as-quot-guest-quot-and-then/m-p/283432#M595 <P>Assuming by "switches" you mean "logs out of the 1st session &amp; logs in again using a different account", - Correct. I figured it would be pretty difficult, and I can't find a way to do it. How about a way just to find if the person logs on to admin during the 1st session?</P> Tue, 05 Apr 2016 18:00:36 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-find-out-if-a-user-logged-in-as-quot-guest-quot-and-then/m-p/283432#M595 steinr23 2016-04-05T18:00:36Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-find-out-if-a-user-logged-in-as-quot-guest-quot-and-then/m-p/283433#M596 <P>here's a good doc:<BR /> <A href="http://docs.splunk.com/Documentation/Splunk/6.0/Troubleshooting/WhatSplunklogsaboutitself">http://docs.splunk.com/Documentation/Splunk/6.0/Troubleshooting/WhatSplunklogsaboutitself</A></P> Tue, 05 Apr 2016 18:16:14 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-find-out-if-a-user-logged-in-as-quot-guest-quot-and-then/m-p/283433#M596 jterry 2016-04-05T18:16:14Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-find-out-if-a-user-logged-in-as-quot-guest-quot-and-then/m-p/283434#M597 <P>Suggest using the latest version of the doc <A href="http://docs.splunk.com/Documentation/Splunk/6.4.0/Troubleshooting/WhatSplunklogsaboutitself">What Splunk logs about itself</A></P> Tue, 05 Apr 2016 18:26:53 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-find-out-if-a-user-logged-in-as-quot-guest-quot-and-then/m-p/283434#M597 dkoshe_splunk 2016-04-05T18:26:53Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-find-out-if-a-user-logged-in-as-quot-guest-quot-and-then/m-p/283435#M598 <P>Assuming by "switches" you mean "logs out of the 1st session &amp; logs in again using a different account", that would be pretty difficult to do w/certainty. If you are indexing network traffic &amp; can ascertain that the admin logged in from the same ip that the non-admin just logged out from, that would be a good indication but who's to say the source ip system was not shared? Splunk provides a very flexible logging system that provides quite a bit of granularity w/regards to how much info is logged but determining who was sitting at a particular keyboard is going to be tough. Another approach might be to correlate "guest" activity w/the admin activity: if the guest was looking at a particular alert, for instance &amp; then an admin logged in and modified that same alert then that's significant.</P> Mon, 11 Apr 2016 17:14:55 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-find-out-if-a-user-logged-in-as-quot-guest-quot-and-then/m-p/283435#M598 jterry 2016-04-11T17:14:55Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-find-out-if-a-user-logged-in-as-quot-guest-quot-and-then/m-p/283436#M599 <P>Also, the question did not specify "logs into Splunk as a guest"</P> <P>And Splunk does not have "guest" login - either you have a Splunk account or you don't. You could login with a less-privileged role...</P> Mon, 11 Apr 2016 21:31:53 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-find-out-if-a-user-logged-in-as-quot-guest-quot-and-then/m-p/283436#M599 lguinn2 2016-04-11T21:31:53Z