topic Creating Bar Chart for SSH logs in Splunk Search

Creating Bar Chart for SSH logs

akashjohn — Tue, 12 Jul 2016 05:41:23 GMT

Hi Team,

We are trying to create a bar chart from secure log. The ultimate goal is to plot the accounts (top 10) used to login to maximum number of servers with count. i.e. the accounts which were used to log into multiple servers. From basic query we were are getting an output as shown below,

We are planning to plot server details (pup-ofc-mar-hjn-a) on X - Axis and users on Y - Axix. Could you please let us know how can we achieve this?

Re: Creating Bar Chart for SSH logs

gcusello — Tue, 29 Sep 2020 10:11:34 GMT

I think that you already loaded logs in an index (e.g.: secure_logs) and extracted the requested fields (user, account, etc...).
Than you have to write a search as the following
index=secure_logs | top users
or
index=secure_logs | stats dc(host) by users | head 10

Bye.
Giuseppe

Re: Creating Bar Chart for SSH logs

akashjohn — Tue, 12 Jul 2016 07:13:30 GMT

Hi Giuseppe,

Thanks for the response. we can fetch the data with the quires, but here the requirement is to plot the accounts (top 10) used to login to maximum number of servers with count. i.e. the accounts which were used to log into multiple servers.

That means we need to fetch the users which are login to multiple servers and need to find the count of servers. The query which you have mentioned is not seems to be working in this case.

Re: Creating Bar Chart for SSH logs

gcusello — Tue, 12 Jul 2016 07:23:34 GMT

with this search you have the number of distict server accessed by each user.

Sorry I forgot to insert sort!
index=secure_logs | stats dc(host) AS hosts by users | sort -hosts | head 10

Bye.
Giuseppe

Re: Creating Bar Chart for SSH logs

akashjohn — Tue, 12 Jul 2016 09:14:13 GMT

Thanks Giuseppe, it seems to be working for me.