topic Re: Pulling back data from users login in using SAML. in Splunk Search

Pulling back data from users login in using SAML.

CMAzurdia — Wed, 23 Apr 2025 15:23:49 GMT

Hello Splunk team,

I need a search query that can pull data back of successful and unsuccessful login attempts of users login into a server using SAML. I also need to create a dashboard of the results. Any additional information needed, please let me know.

Do I need to extract a field of all the users using SAML?

v/r

cmazurdia

Re: Pulling back data from users login in using SAML.

livehybrid — Wed, 23 Apr 2025 15:42:08 GMT

Hi @CMAzurdia

Typically success/failed login attempts are recorded by the Identity Provider (IdP) rather than Splunk, however you can see successful logins to Splunk from SAML users with the following query:

index=_internal method=POST uri=/saml/acs | table _time user clientip

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Pulling back data from users login in using SAML.

CMAzurdia — Wed, 23 Apr 2025 16:16:48 GMT

The query did not error, but also 0 events. Any other way? I have created a lookup table.

Re: Pulling back data from users login in using SAML.

CMAzurdia — Wed, 23 Apr 2025 17:33:34 GMT

I have a server pushing audit logs data to a syslog, to login to the server you need SAML. My question is: how do I pull data of successful logins and unsuccessful logins of those SAML users in Splunk?

Thank you.

Re: Pulling back data from users login in using SAML.

livehybrid — Wed, 23 Apr 2025 21:25:55 GMT

Hi @CMAzurdia

My apologies, I thought you were referring to people logging in to Splunk using SAML.

Ultimately this depends on what the data looks like when you receive it in Splunk? Its worth starting by identifying key fields in your data and then filtering down until you just get the events you are interested in - from here you can work through your usecase/requirements.

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing