Top User Access Query

[sourabh_v]

Hi,

I want to make a search query on Linux which gives me a list of top 5 users who have accessed the linux machine the most number of times. I have /var/log/secure logs monitored. Please help.

[dmaislin_splunk]

An example log is helpful here, but you simply splunk the logs, create a field called user if it doesn't exist already, and then run the search. For example, if I want to see this result for the past 30 days:

sourcetype=mysecurelog earliest=-30d latest=now | top user limit=5