Archive

SPL to find first time account access

corecomputetool
New Member

To find the user first time login in PCI compilance - what is the SPL query ?

I am using the query as below :

| from inputlookup:access_tracker | stats min(firstTime) as firstTime,values(dest) as dest by user | sort 100 - firstTime | uitime(firstTime) | fields dest user firstTime

Tags (1)
0 Karma

Adrian_ftx
Path Finder

Hi,

Can you provide a sample of your data and the expected result please?
Can you share the return of your SPL request too please?

Best regards,
Adrian

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.