topic Re: timechart in Splunk Search

How to use timechart to display failed user login info, sorted by time/date of each login attempt?

rkris — Tue, 21 Jul 2020 21:06:04 GMT

I'm trying to display failed user login information by using a timechart but I'm not sure how to show the time and date of the logins for each of the user

This is my code :

source="General-linux-sql.log" AND sourcetype="Linux" AND "Failure Audit" AND "Logon " | rex "User Name\: (?<User_Name>[^\s]+)" | timechart count by User_Name

This is the output that I get. Also, how do I change it so that all the users are separated?

Re: timechart

anilchaithu — Tue, 21 Jul 2020 03:20:11 GMT

@rkris

you can do the following to see users

change area chart to line chart (OR) column chart
If you choose line chart, Format -> General -> Multi series mode -> yes

you can play with both chart type & format options to improve look and feel.

Hope this helps

Re: timechart

rkris — Tue, 21 Jul 2020 03:55:03 GMT

How do I display the time for each of the logins as well?

Re: timechart

rkris — Tue, 21 Jul 2020 03:59:27 GMT

Re: timechart

rkris — Tue, 21 Jul 2020 09:24:32 GMT

@anilchaithu

Thanks for the solution! However, now I have another problem with the Y-axis title. The title is now unreadable even though I changed it. Do you have any fix for this?

Re: timechart

isoutamo — Fri, 24 Jul 2020 20:46:18 GMT

Have you tried trellis as visualization? It should work if you have less than 20 user and if more then you must divide those to group of 20.

r. Ismo