Archive

How to search for which users were logged in to a machine at a certain time or date on linux given the workstation name ?

New Member

I have the workstation name and IP address — how do I find out which users were logged in to the machine (Linux) and Windows, if possible?

Tags (1)
0 Karma

SplunkTrust
SplunkTrust

What data from that machine does Splunk have? Are you indexing the audit log? Maybe the 'who' command from the Linux TA? It's hard to answer this question without knowing what there is to work with.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

New Member

Yes I am indexing audit logs.

0 Karma