Splunk Search

How do I search for low counts of specific user logons per host?

rwmilligan
Explorer

I'm trying to do some least common occurance hunting in our environment, and would like to see if I can make a search that will show me hosts with low counts of user logons (say, less than 5?).

So, if my machine had me log in 30 times, and a pc tech once, even though it's legit it would show the pc tech on my machine in the search.

0 Karma

renjith_nair
Legend

@rwmilligan,

what about rare user ?

Happy Splunking!
0 Karma

imthesplunker
Path Finder

Assuming the user is xyz.

index=_internal file=login user!=- NOT streamedsearch user=xyz |stats count by host user | where count<5

0 Karma

rwmilligan
Explorer

Not by user... I would like it to show ANY user with low counts on any machine. I'll try the "rare user" command listed above, see how that works out for me.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...