How can I generate a report of users and machine usage by machine name?

jcftx7 — Thu, 17 Aug 2017 21:20:43 GMT

I am looking at a log of users logging into machines. The two fields I am interested in are: Username and Machine name.

What I am trying to get my report to look like is a list of usernames, with machine names and a count of the records per machine.
Hoping for something like this...

Bob Smith:
Machine 1 - 16 times
Machine 2 - 2 times
Machine 3 - 6 times
Sam Jones:
Machine1 - 3 times
Machine2 - 1 time

etc....

Right now I have stats count by Username, MachineName | sort - count
And I am lost at this point as to how to change the query to format the way I need it..
Thanks for your help!

Re: How can I generate a report of users and machine usage by machine name?

tmarlette — Thu, 17 Aug 2017 21:45:48 GMT

So people will probably need a bit more information in order to answer this question.

This means adding details like:
1. windows or Linux or manufacture / appliance name
2. a pasted login event from your logs
3. your full search query syntax from start to finish

I'm not sure which OS or Log Type your looking at to know if your seeing login events, or connection events, or file copy events or what. There's a whole slew of login types that we're just gonna overlook here to see if I can help get you something that can work.

Assuming you have a perfect log that clarly says 'host=blah user=blah action=Login' and all of those fields are extracted properly, or something of the sort, you could try this:

<my_root_search_here> action=Login | stats count by UserName MachineName | sort - count

That should give you a table output.

topic How can I generate a report of users and machine usage by machine name? in Splunk Search

How can I generate a report of users and machine usage by machine name?

Re: How can I generate a report of users and machine usage by machine name?