topic Re: How can I create a table showing successful logins on a server? in Splunk Search

How can I create a table showing successful logins on a server?

mcoleman2 — Mon, 22 Sep 2014 14:40:48 GMT

How do I create a table that lists which user logged in to the windows server and the time that they successfully logged in?

Re: How can I create a table showing successful logins on a server?

alacercogitatus — Mon, 22 Sep 2014 15:55:05 GMT

Depends on your source data - but here may be an example.

host=<your_server> EventCode=4624 | stats latest(login_time) by user

You will most likely need to change the field names to match your data.

Re: How can I create a table showing successful logins on a server?

kmattern — Mon, 22 Sep 2014 16:14:43 GMT

In its simplest form, assuming you're searching an IIS log, use something like this

index=IIS sourcetype=IIS sc_status=200 cs_username!="-" | table date, time, cs_username

If you only want the first entry for each user use this

index=IIS sourcetype=IIS sc_status=200 cs_username!="-" | dedup cs_username | table date, time, cs_username

Of course your index and sourcetype may vary but you should get the idea

Re: How can I create a table showing successful logins on a server?

alacercogitatus — Mon, 22 Sep 2014 16:25:58 GMT

To more exactly get a search that is useful - we need your Windows Server version.

Re: How can I create a table showing successful logins on a server?

mcoleman2 — Mon, 22 Sep 2014 16:27:30 GMT

host= source="WinEventLog:Security" | table _time User

The above code worked well for what I wanted. Thank you both!

Re: How can I create a table showing successful logins on a server?

mcoleman2 — Mon, 22 Sep 2014 16:28:20 GMT

Windows Server 2003

Re: How can I create a table showing successful logins on a server?

alacercogitatus — Mon, 22 Sep 2014 16:33:48 GMT

sourcetype=WineventLog:Security EventCode=528 | stats latest(_time) as "Logged In" by user host

Re: How can I create a table showing successful logins on a server?

alacercogitatus — Mon, 22 Sep 2014 16:34:58 GMT

We aren't assuming IIS - We KNOW Windows, it was in the problem description. Be careful using dedup - the search head must pull all matching events forward first, deduplicate (assuming you have the correct time order of events) and then table.