https://community.splunk.com/t5/Deployment-Architecture/Top-User-Access-Query/m-p/149202#M5556 <P>Hi,</P> <P>I want to make a search query on Linux which gives me a list of top 5 users who have accessed the linux machine the most number of times. I have /var/log/secure logs monitored. Please help.</P> Thu, 13 Feb 2014 11:39:40 GMT sourabh_v 2014-02-13T11:39:40Z https://community.splunk.com/t5/Deployment-Architecture/Top-User-Access-Query/m-p/149202#M5556 <P>Hi,</P> <P>I want to make a search query on Linux which gives me a list of top 5 users who have accessed the linux machine the most number of times. I have /var/log/secure logs monitored. Please help.</P> Thu, 13 Feb 2014 11:39:40 GMT https://community.splunk.com/t5/Deployment-Architecture/Top-User-Access-Query/m-p/149202#M5556 sourabh_v 2014-02-13T11:39:40Z https://community.splunk.com/t5/Deployment-Architecture/Top-User-Access-Query/m-p/149203#M5557 <P>An example log is helpful here, but you simply splunk the logs, create a field called user if it doesn't exist already, and then run the search. For example, if I want to see this result for the past 30 days:</P> <P>sourcetype=mysecurelog earliest=-30d latest=now | top user limit=5</P> Thu, 13 Feb 2014 13:24:24 GMT https://community.splunk.com/t5/Deployment-Architecture/Top-User-Access-Query/m-p/149203#M5557 dmaislin_splunk 2014-02-13T13:24:24Z