https://community.splunk.com/t5/Deployment-Architecture/Unix-Linux-login-account-aduiting/m-p/159897#M6000 <P>To start index your /var/log/secure, and search on it.<BR /> <CODE>source=/var/log/secure login</CODE><BR /> and look at the format of your events to narrow your search.</P> <P>You can use the splunk search language to extract the fields you need, probably user and result.<BR /> see the field extractions manual or the rex command <A href="http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Rex">http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Rex</A></P> <P>Then count the number or success and failures per user. <BR /> <CODE>&lt;mysearch&gt; | stats count by user result</CODE><BR /> or a chart<BR /> <CODE>&lt;mysearch&gt; | chart count over result by user</CODE><BR /> etc ....</P> <P>for the search commands, look at <A href="http://docs.splunk.com/Documentation/Splunk/latest/Search/Whatsinthismanual">http://docs.splunk.com/Documentation/Splunk/latest/Search/Whatsinthismanual</A></P> Thu, 28 Nov 2013 16:49:47 GMT yannK 2013-11-28T16:49:47Z https://community.splunk.com/t5/Deployment-Architecture/Unix-Linux-login-account-aduiting/m-p/159896#M5999 <P>I working on creating reports for Top successful login and Top failed login in Unix/Linux or related OS.</P> <P>Would need help on that.</P> <P>Thanks <BR /> Kishore</P> Thu, 28 Nov 2013 15:20:30 GMT https://community.splunk.com/t5/Deployment-Architecture/Unix-Linux-login-account-aduiting/m-p/159896#M5999 Kishorebk 2013-11-28T15:20:30Z https://community.splunk.com/t5/Deployment-Architecture/Unix-Linux-login-account-aduiting/m-p/159897#M6000 <P>To start index your /var/log/secure, and search on it.<BR /> <CODE>source=/var/log/secure login</CODE><BR /> and look at the format of your events to narrow your search.</P> <P>You can use the splunk search language to extract the fields you need, probably user and result.<BR /> see the field extractions manual or the rex command <A href="http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Rex">http://docs.splunk.com/Documentation/Splunk/6.0/SearchReference/Rex</A></P> <P>Then count the number or success and failures per user. <BR /> <CODE>&lt;mysearch&gt; | stats count by user result</CODE><BR /> or a chart<BR /> <CODE>&lt;mysearch&gt; | chart count over result by user</CODE><BR /> etc ....</P> <P>for the search commands, look at <A href="http://docs.splunk.com/Documentation/Splunk/latest/Search/Whatsinthismanual">http://docs.splunk.com/Documentation/Splunk/latest/Search/Whatsinthismanual</A></P> Thu, 28 Nov 2013 16:49:47 GMT https://community.splunk.com/t5/Deployment-Architecture/Unix-Linux-login-account-aduiting/m-p/159897#M6000 yannK 2013-11-28T16:49:47Z