topic Re: Can you help us find web GUI log in attempts from index=_audit? in Monitoring Splunk

Can you help us find web GUI log in attempts from index=_audit?

stwong — Thu, 20 Dec 2018 08:31:02 GMT

Hi,

We're looking for web GUI log in attempts from index=_audit. Note that for event like following:

Audit:[timestamp=12-20-2018 12:15:38.921, user=user123, action=login attempt, info=succeeded, src=12.34.56.78][n/a]

the "action" field is set to "success" instead of "login attempt".

Was it set somewhere? Sorry for the newbie question.

Thanks a lot.
Regards

EDIT: removed the ip address

Re: Can you help us find web GUI log in attempts from index=_audit?

inventsekar — Thu, 20 Dec 2018 08:55:52 GMT

i hope the info=succeeded is what you are looking for:
Audit:[timestamp=12-20-2018 12:15:38.921, user=user123, action=login attempt, info=succeeded, src=12.34.56.78][n/a]

index="_audit" action=*login*

my question on this same topic:
https://answers.splunk.com/answers/686177/is-there-a-splunk-account-lockout-for-users-if-you.html

As you are a new user to Splunk Answers, you can upvote the answers/comments,
if this answer resolved your query, you can select this answer and "accept" it as the answer, so that this question will be moved to answered queue. Happy Splunking!

Re: Can you help us find web GUI log in attempts from index=_audit?

stwong — Thu, 20 Dec 2018 10:23:54 GMT

Hi, thanks for your help.
I'm just interest to know which configuration makes Splunk changed value of "action" into something different to that stated in the events...

Re: Can you help us find web GUI log in attempts from index=_audit?

dkeck — Thu, 20 Dec 2018 10:39:25 GMT

Hi,

could be that someone created a field extraction for audittrail to change the value to "success", since its not the default value.

You should check that, for example in "All configurations" or you could grep on the UI in directory $SPLUNK_HOME/etc/users for the word action command: grep -R action

Re: Can you help us find web GUI log in attempts from index=_audit?

inventsekar — Thu, 20 Dec 2018 12:41:17 GMT

I'm just interest to know which configuration makes Splunk changed value of "action" into something different to that stated in the events...
i think there are no configurations. It is just the audit log format Splunk developers selected.

there are only 2 choices:
action=login attempt, info=succeeded
action=login attempt, info=failed

Re: Can you help us find web GUI log in attempts from index=_audit?

stwong — Thu, 20 Dec 2018 17:40:02 GMT

Thanks and agree. But when expanding the event fields on web interfrace, we can see that the "action" attribute is set to "success", not "login attempt".

Re: Can you help us find web GUI log in attempts from index=_audit?

stwong — Tue, 29 Sep 2020 22:26:55 GMT

Thanks. Found that it's done by a transform in the CIM add-on $SPLUNKE_HOME/etc/apps/Splunk_SA_CIM/default/props.conf.

Thanks a lot.