Archive

List of user who have logged into Splunk in the last 30 days and what Apps/Indexes they accessed.

Path Finder

Hi,
Looking to get some help with a query for the following.

List of user who have logged into Splunk in the last 30 days and what Apps/Indexes they accessed.

Thanks.

Tags (1)
0 Karma
1 Solution

Legend

Hi aknsun,
to know the logged in Splunk users you have to run a search like this

index=_audit sourcetype = audittrail action="login attempt" 

To know the App accessed you can use something like this:

index=_internal sourcetype="splunk_web_access" method="GET" status="200" user!=-
| rex field=uri ".*\/app\/(?<app>[^\/]*)\/"

To correlate them, you could run something like this:

(index=_internal sourcetype="splunk_web_access" method="GET" status="200" user!=-) OR (index=_audit sourcetype = audittrail action="login attempt")
| rex field=uri ".*\/app\/(?<app>[^\/]*)\/"
| stats count BY user app

Ciao.
Giuseppe

View solution in original post

0 Karma

Legend

Hi aknsun,
to know the logged in Splunk users you have to run a search like this

index=_audit sourcetype = audittrail action="login attempt" 

To know the App accessed you can use something like this:

index=_internal sourcetype="splunk_web_access" method="GET" status="200" user!=-
| rex field=uri ".*\/app\/(?<app>[^\/]*)\/"

To correlate them, you could run something like this:

(index=_internal sourcetype="splunk_web_access" method="GET" status="200" user!=-) OR (index=_audit sourcetype = audittrail action="login attempt")
| rex field=uri ".*\/app\/(?<app>[^\/]*)\/"
| stats count BY user app

Ciao.
Giuseppe

View solution in original post

0 Karma

Path Finder

Thanks @gcusello. That worked.

0 Karma