topic Logging Splunk enterprise sign ins? in Getting Data In

Logging Splunk enterprise sign ins?

ceichhorn — Thu, 02 Apr 2015 13:27:42 GMT

This question has likely been asked, but the language makes it difficult to search for.

I'm looking to create a search which lists every time someone has logged in to the Splunk Enterprise interface. Is there a simple search that outputs this data? Thanks very much!

Re: Logging Splunk enterprise sign ins?

aljohnson_splun — Thu, 02 Apr 2015 14:24:06 GMT

Try looking at the _audit index.

For example, just exploring:

index=_audit login

reveals there is a field action with a value login attempt (note the space), furthermore, there is a field info that has the values either succeeded or failed. which leads us towards a better search like:

index=_audit action="login attempt" info=succeeded
| timechart count by user

or something of the sort.

Re: Logging Splunk enterprise sign ins?

ceichhorn — Thu, 02 Apr 2015 14:48:08 GMT

Thanks, this got it! Much appreciated.