Hi Splunk Community
I am completely new on splunk. I somehow managed to deploy the splunk Universal Forwarder on many linux nodes and few windows systems.
I am able to view the /var/log/secure and /var/log/message that are getting indexed and the windows security event log on the created index.
I want a dashboard that shows information of the below :-
1. Number of Hosts where splunk forwarder is deployed (linux and windows separate).
2. Successfull and failed login.
3. Alert when root is logged in linux and Administrator login in windows.
you're asking many easy things:
to have the list of servers that are sending logs, you could run something like this:
| metasearch index=os or index=wineventlog | stats count BY index
but in this case you have only the servers that are sending logs, if a server is missing you haven't it, but this is another question that you can search in Community.
For successul or unsuccessful logins there's a problem, that every windows login generates around 10-12 login events (EventCode=4624) so the results could be non reliable.
Anyway, the search could be (for windows) something like this:
index=wineventlog EventCode=4624 OR EventCode=4625 | stats count BY EventCode
and for Linux, something like this:
search = index=os sourcetype=linux_secure NOT disconnect ("accepted password" OR "failed password") | eval action=if(searchmatch("accepted password"),"Login","LogFail") | stats count BY action
If you want all in one panel it's just a little bit complicate because you should create four eventtypes:
using the above searches and associating to eventtypes LOGIN or LOGOUT tags, then you can run a simple search using tags:
tag=LOGIN OR tag=LOGFAIL | stats count BY index tag
About the alert for root or administrator, you have to search for the eventtypes windows_login or linux_login and the words root or administrator, something like this:
tag=LOGIN (root OR administrator)
Only one final hint: follow the Search Tutorial to understand SPL.
For dashboards, you would need to create the search matching your need and save it as a view. I would also suggest you completing https://www.splunk.com/en_us/training/free-courses/splunk-fundamentals-1.html and looking at Splunk dashboards example app and Splunk unix app in splunk base - https://splunkbase.splunk.com/app/273/