topic Re: Query user login over a period of time in Splunk Search

Query user login over a period of time

Skadrir — Wed, 17 Jul 2024 13:00:55 GMT

I am trying to query our windows and linux indexes to verify how many times a user has logged in over a period of time.

Currently, I only care about the last 7 days. I've tried to run some queries, but it's not very fruitful.

Can I gain some assistance with generating a query for determining the number of logins over a period of time, please?

Thank you.

Re: Query user login over a period of time

yuanliu — Wed, 17 Jul 2024 16:12:48 GMT

This is a Splunk forum. No one here knows what your data source looks like. To ask an answerable data analytics question, follow these golden rules; nay, call them the four commandments:

Illustrate data input (in raw text, anonymize as needed), whether they are raw events or output from a search that volunteers here do not have to look at.
Illustrate the desired output from illustrated data.
Explain the logic between illustrated data and desired output without SPL.
If you also illustrate attempted SPL, illustrate actual output and compare with desired output, explain why they look different to you if that is not painfully obvious.

Re: Query user login over a period of time

Skadrir — Wed, 17 Jul 2024 16:47:25 GMT

Effectively I want to comb through the windows event logs to determine logon dates and times for a specific user(s) and output those entries into a table with username, date and time. We have a windows index and we want to query the last seven days and the number of logins for a given user.

I would imagine it'd be fairly simple to do, I just don't SPL. This is why I engaged the brain trust online in this forum. I don't splunk as a day job, so I'm not familiar with the intricacies with SPL.

In short, give all entries from windows security logs for the last seven days from the windows index for a specific user with event ID 4624.

Thank you.

Re: Query user login over a period of time

fredclown — Wed, 17 Jul 2024 18:06:42 GMT

Is something like this what you are looking for? Set the time range picker to your desired range.

index=windows EventCode=4624 Account_Name IN ("Larry","Curly","Moe") | eval Logon_Account_Name=mvindex(Account_Name, 1) | table _time, ComputerName, Logon_Account_Name | sort _time

Re: Query user login over a period of time

Skadrir — Wed, 17 Jul 2024 20:14:42 GMT

I tailored the query to the appropriate fields and viola it worked.

I appreciate your efforts and thank you for your time.