Getting Data In

First appears to be broken on my search

Eastek5551
Engager

I have a search tracking users logging into our juniper vpn

sourcetype="SSLVPN" Action="- Login succeeded" |eval Username=lower(Username) | stats sparkline first(LoginTime) as LastLogin count by Username | sort -count | head 10

Everything works perfect when it is set to last 24 hours but when I change the timeline to 30 days (the default) the first value of LastLogin is wrong on half the users, the count is correct but first is dropping off the last 24 hours worth of logins

it is related to username=lower(Username) I am using this because users sign in as Jimmy.zio and jimmy.zio both work and I am aggregating the users into 1

Tags (1)
0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

The first command returns the first value in the events list. So if the "first" event is 7 days ago, it will show that one. first and last are not chronological commands, they are based on the input order of the events. Instead, try this, which uses the latest command:

sourcetype="SSLVPN" Action="- Login succeeded" |eval Username=lower(Username) | stats sparkline latest(LoginTime) as LastLogin count by Username | sort -count | head 10

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Commonstatsfunctions

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

The first command returns the first value in the events list. So if the "first" event is 7 days ago, it will show that one. first and last are not chronological commands, they are based on the input order of the events. Instead, try this, which uses the latest command:

sourcetype="SSLVPN" Action="- Login succeeded" |eval Username=lower(Username) | stats sparkline latest(LoginTime) as LastLogin count by Username | sort -count | head 10

http://docs.splunk.com/Documentation/Splunk/5.0/SearchReference/Commonstatsfunctions

alacercogitatus
SplunkTrust
SplunkTrust

Your welcome! please use the checkmark and mark accepted. Thanks!

0 Karma

Eastek5551
Engager

Perfect thanks fixed my search

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...