https://community.splunk.com/t5/Deployment-Architecture/Splunk-Search-Query-for-Logged-in-Users-on-Linux-Servers/m-p/491576#M17023 <P>Do you have any app that keep tracks on this so you can search for it?<BR /> Or do you want to see usernames that are logged into a splunk instance running on a Linux server?</P> Wed, 02 Oct 2019 12:06:31 GMT broberg 2019-10-02T12:06:31Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-Search-Query-for-Logged-in-Users-on-Linux-Servers/m-p/491575#M17022 <P>What is the splunk Search Query for Logged-in Users on Linux Servers <BR /> I want to have dashboard for currently logged in users in Linux Servers</P> Tue, 01 Oct 2019 08:50:24 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-Search-Query-for-Logged-in-Users-on-Linux-Servers/m-p/491575#M17022 umesh_phendarka 2019-10-01T08:50:24Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-Search-Query-for-Logged-in-Users-on-Linux-Servers/m-p/491576#M17023 <P>Do you have any app that keep tracks on this so you can search for it?<BR /> Or do you want to see usernames that are logged into a splunk instance running on a Linux server?</P> Wed, 02 Oct 2019 12:06:31 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-Search-Query-for-Logged-in-Users-on-Linux-Servers/m-p/491576#M17023 broberg 2019-10-02T12:06:31Z https://community.splunk.com/t5/Deployment-Architecture/Splunk-Search-Query-for-Logged-in-Users-on-Linux-Servers/m-p/491577#M17024 <P>If you want to search for linux users current login, you should identify the linux log where this data is being send to and index this file into Splunk.<BR /> Possible steps to take:<BR /> create an input to read this log file, assign this data to an index and sourcetype<BR /> Sample:<BR /> [monitor:///var/log/.log]<BR /> disabled = false<BR /> sourcetype = secure_log<BR /> index=linux<BR /> Depends on how the user information is showing on the file, there is a potential regex usage to extract the user from the log, if splunk is not capable to extract this info.</P> <P>Please see a sample of code from this link. In this sample, the index is not specified, thus I recommend to always specify an index to assigned your indexed data and to not relying on default configuration if you are running on large splunk environment to avoid performance issues<BR /> <A href="https://gosplunk.com/list-of-users-in-a-linux-environment/">https://gosplunk.com/list-of-users-in-a-linux-environment/</A></P> <P>Splunk potential search based on the link attached above</P> <P>index=linux sourcetype=secure_log | rex "\suser<A href="https://community.splunk.com/?S+w+">^'</A>" | stats count by User</P> Thu, 03 Oct 2019 05:48:47 GMT https://community.splunk.com/t5/Deployment-Architecture/Splunk-Search-Query-for-Logged-in-Users-on-Linux-Servers/m-p/491577#M17024 ivanreis 2019-10-03T05:48:47Z