Getting Data In

How do you search Multiple users logged into a single machine at the same time?

Casial06
Explorer
 
Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This is a bit vague - what events are you dealing with (please provide anonymised samples)?

In general, you could assign log on events a value 1 and log off events a value -1, then do a streamstats summing these values and when the sum is above 1 you have multiple users logged on. You would have to take care of the issue of log off events appearing without a preceding log on event, and all this tell you is the change, you might want to consider setting your start time to be when there is known to be zero users logged on.

0 Karma

Casial06
Explorer

So, I am searching for Multiple users logged into a single machine at the same time, or even within the same hour.

Initially this is my search query to display how many users log-on in 1 host.

index="windows" sourcetype="WinEventLog" EventCode=4624
| search host!="*$*"
| stats dc(user) as user_count by host

the problem is it does not count the current user since there's log off events. hope I explained that clearly. Thanks.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is EventCode 4624? Is that a log on, a log off or either? If it is either, how do you distinguish between the two? If it is one or the other, which events signify the other event? Essentially, how can you tell from your data when a user logs on and when they log off?

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...