topic Re: Return First user and _time from ACS syslog in Splunk Search

Return First user and _time from ACS syslog

buldamoosh — Mon, 28 Sep 2020 11:27:27 GMT

Firstly, my data is formatted like this:

Dec 15 13:58:12 gthou-nsacs01p CisACS_01_PassedAuth ne8yfimc 1 0 Message-Type=Authen OK,User-Name=Adorton,NAS-IP-Address=10.71.11.7,Caller-ID=174.253.112.223,NAS-Port=124190720,Group-Name=VPN Neudesic,Filter Information=No Filters activated.,AAA Server=gthou-nsacs01p,Network Device Group=Wireless and VPN,Access Device=phe-ardmore-int-sa00-rad,

I've created an eventtype which keys on "Message-Type=Authen OK" called acs-authentication-success. The query I'm working off of looks like this:

eventtype=acs-authentication-success | uniq User_Name | sort User_Name, -_date | fields User_Name, _time

However, rather than displaying the latest time that every User_Name was seen in the syslog data, it returns EVERY individual instance. I'm new to splunk reporting and would appreciate any assistance. Thanks in advance!

Re: Return First user and _time from ACS syslog

gkanapathy — Tue, 28 Feb 2012 18:16:06 GMT

First, do not use uniq. I don't even know why it even exists. Try:

eventtype=acs-authentication-success | dedup User_Name | fields User_Name, _time

eventtype=acs-authentication-success | stats latest(_time) by User_Name

Re: Return First user and _time from ACS syslog

buldamoosh — Tue, 28 Feb 2012 18:40:51 GMT

Awesome, that definitely got my results as I expected them. Thank you so much! Can you point me to a document that will help me to export the dataset to a CSV with the User_name and the _time?