https://community.splunk.com/t5/Getting-Data-In/search-for-logins-to-splunk-itself/m-p/9742#M168 <P>You can use this search:</P> <PRE><CODE>index=_audit sourcetype=audittrail action=success </CODE></PRE> Fri, 26 Oct 2018 18:47:23 GMT drutstein 2018-10-26T18:47:23Z https://community.splunk.com/t5/Getting-Data-In/search-for-logins-to-splunk-itself/m-p/9739#M165 <P>I need a search that can show me who is logging into our splunk instance itself. Not monitor logins to systems that are logging to splunk but monitor who is using splunk itself... I am tinkering with something like "index=_internal sourcetype=access_combined" but can't find the actual "login" event.</P> Mon, 15 Feb 2010 04:21:04 GMT https://community.splunk.com/t5/Getting-Data-In/search-for-logins-to-splunk-itself/m-p/9739#M165 Sean 2010-02-15T04:21:04Z https://community.splunk.com/t5/Getting-Data-In/search-for-logins-to-splunk-itself/m-p/9740#M166 <P>OK, being kindof stupid, the Search Status dashboard has something like what I am looking for that I can use. One of the panels has "UI activity by user" that can be run separately. Namely: "index="<EM>internal" source="</EM>/splunkd_access.log" "/services/search/jobs" | kv access-extractions | search uri=/services/search/jobs/* user!="-"| rex (?\d+)ms$ | timechart eval(sum(run_time)/1000) by user" This works for my purposes.</P> Mon, 15 Feb 2010 04:52:26 GMT https://community.splunk.com/t5/Getting-Data-In/search-for-logins-to-splunk-itself/m-p/9740#M166 Sean 2010-02-15T04:52:26Z https://community.splunk.com/t5/Getting-Data-In/search-for-logins-to-splunk-itself/m-p/9741#M167 <P>Actually, if you <EM>logins</EM> to Splunk as opposed the searches submitted, you can also search:</P> <PRE><CODE>index=_audit action="login attempt" info=succeeded </CODE></PRE> Mon, 15 Feb 2010 10:59:53 GMT https://community.splunk.com/t5/Getting-Data-In/search-for-logins-to-splunk-itself/m-p/9741#M167 gkanapathy 2010-02-15T10:59:53Z https://community.splunk.com/t5/Getting-Data-In/search-for-logins-to-splunk-itself/m-p/9742#M168 <P>You can use this search:</P> <PRE><CODE>index=_audit sourcetype=audittrail action=success </CODE></PRE> Fri, 26 Oct 2018 18:47:23 GMT https://community.splunk.com/t5/Getting-Data-In/search-for-logins-to-splunk-itself/m-p/9742#M168 drutstein 2018-10-26T18:47:23Z