topic Help searching the keyword to select multiple users from my log file to get the report in Splunk Search

Help searching the keyword to select multiple users from my log file to get the report

gow19 — Tue, 08 Mar 2022 04:51:34 GMT

Hi guys,

I am using Splunk enterprise for monitoring the application name called Nextcloud.

Here I want to customize the dashboard for Nextcloud for that I have imported my nextcloud.log into my Splunk.

In my log file, it has user: xxxxx

I want to search the keyword to select multiple users from my log file to get the report I don't know what is keyword it is been used to pull the data. Can anyone help me with this?

Sample Keywords:

source="/xxx/xxx/xxx/nextcloud.log" host="nextcloud" sourcetype="Nextcloud" | search user= "*"

The above command works for every user but i want to get reports of only 2 users how do i do that?

Re: Splunk Search & Reporting Keyword

gcusello — Mon, 07 Mar 2022 13:12:24 GMT

Hi @gow19,

sory but I don't understand what you mean with "keyword".

in your sample, you define "keyword" four field conditions, maybe do you mean a condition?

or you want to know te users with more than one event?

or do you want to find a field values where there is more than one user, or what else?

Ciao.

Giuseppe

Re: Splunk Search & Reporting Keyword

richgalloway — Mon, 07 Mar 2022 13:14:42 GMT

Rather than use user="*" to search for all users, specify the list of users in an IN clause.

index=myindex source="/xxx/xxx/xxx/nextcloud.log" host="nextcloud" sourcetype="Nextcloud" user IN (foo bar)