How to create a splunk alert if the user login to splunk via local credential using Splunk login type?

[mala_fmr]

Hi, 

We have 2 Splunk authentication systems - SAML,Splunk (default). We wanted to have an alert, if the user login to Splunk via "Splunk" authentication system.

Is there way to do that? Can we do this via Splunk query?
need help on this.

Thanks,

Mala S

[richgalloway]

That's in the audit logs.

index=_audit info=succeeded method=Splunk user!=internal_observability

[starcher]

with some cleanup since Splunk can't onboard their own audit logs.

index=_audit info=succeeded method=Splunk user!=internal_observability
| rename useragent as http_user_agent
| eval signature=reason." local splunk user login", src=coalesce(clientip,"unknown"), session_id=session
| iplocation prefix=src_ src