topic How can i find a full list of Users using IP address in Splunk Search

How can i find a full list of Users using IP address

robertlynch2020 — Tue, 29 Sep 2020 16:37:26 GMT

I have the below command that i think works 95% of the time.

index=_internal sourcetype=splunkd_ui_access | stats count by clientip , user , _time | lookup dnslookup clientip | timechart span=1d distinct_count(clienthost) by clienthost limit=100

The issues is sometime is reports users that did not use the system. I think this might be because of IP address changing. However i am not 100% about this.

Any help would be brill.

Re: How can i find a full list of Users using IP address

gcusello — Fri, 03 Nov 2017 12:20:03 GMT

Hi robertlynch2020,
surely IP address changes because is assigned by a dns.
Anyway you could create a lookup with a list of all users.
You could maintain this lookup with a scheduled search or an extraction from Active Directory.
If you have this lookup you can check the users in your search and list the ones not present:

index=_internal sourcetype=splunkd_ui_access
| eval user=lower(user)
| stats count BY user
| append [ | inputlookup user_lookup.csv | eval user=lower(user), count=0 | fields user count ]
| stats sum(count) AS Total by user

In this way users with Total=0 are missed and users with Total greater than 0 are present.

Bye.
Giuseppe

Re: How can i find a full list of Users using IP address

horsefez — Fri, 03 Nov 2017 12:24:40 GMT

Hi,

The issues is sometime is reports users that did not use the system. I think this might be because of IP address changing. However i am not 100% about this.

This doesn't sound right... how should splunk know about the names of other users that didn't access the instance??