topic User activities in single query in Reporting https://community.splunk.com/t5/Reporting/User-activities-in-single-query/m-p/532737#M8622 <P>HI Team,</P><P>I'm new to splunk..could&nbsp;</P><P>How to check the different activities by listed users(ex: 10 users) from single query</P><P>1)password failure</P><P>2)Malware operations/malicious file</P><P>3)Traffic towards malicious public IP</P><P>4)Suspicious mail activity</P> Fri, 11 Dec 2020 03:47:22 GMT SPLUNK111 2020-12-11T03:47:22Z User activities in single query https://community.splunk.com/t5/Reporting/User-activities-in-single-query/m-p/532737#M8622 <P>HI Team,</P><P>I'm new to splunk..could&nbsp;</P><P>How to check the different activities by listed users(ex: 10 users) from single query</P><P>1)password failure</P><P>2)Malware operations/malicious file</P><P>3)Traffic towards malicious public IP</P><P>4)Suspicious mail activity</P> Fri, 11 Dec 2020 03:47:22 GMT https://community.splunk.com/t5/Reporting/User-activities-in-single-query/m-p/532737#M8622 SPLUNK111 2020-12-11T03:47:22Z Re: User activities in single query https://community.splunk.com/t5/Reporting/User-activities-in-single-query/m-p/532754#M8624 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/229650">@SPLUNK111</a>,</P><P>you question is just a little bit vague!</P><P>How can I help you without knowing which are the data where to extract fields and create searches?</P><P>Anyway, your approach should be:</P><UL><LI>analyze your data,</LI><LI>extract fields to use in all your searches (using regexes or the Interactive Field Extractor),</LI><LI>create one by one your searches answering to you use cases.</LI></UL><P>If you're new, the best approach is to follow the Splunk Fundamentals I course (<A href="https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html" target="_blank">https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html</A>) and the Splunk Search Tutorial (<A href="https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchTutorial/WelcometotheSearchTutorial" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.1.0/SearchTutorial/WelcometotheSearchTutorial</A>) to understand how to do the above activities.</P><P>In addition on YouTube you can find many videos about this.</P><P>Ciao.</P><P>Giuseppe</P> Fri, 11 Dec 2020 08:29:53 GMT https://community.splunk.com/t5/Reporting/User-activities-in-single-query/m-p/532754#M8624 gcusello 2020-12-11T08:29:53Z