Getting Data In

How do you search Multiple users logged into a single machine at the same time?

Casial06
Explorer
 
Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This is a bit vague - what events are you dealing with (please provide anonymised samples)?

In general, you could assign log on events a value 1 and log off events a value -1, then do a streamstats summing these values and when the sum is above 1 you have multiple users logged on. You would have to take care of the issue of log off events appearing without a preceding log on event, and all this tell you is the change, you might want to consider setting your start time to be when there is known to be zero users logged on.

0 Karma

Casial06
Explorer

So, I am searching for Multiple users logged into a single machine at the same time, or even within the same hour.

Initially this is my search query to display how many users log-on in 1 host.

index="windows" sourcetype="WinEventLog" EventCode=4624
| search host!="*$*"
| stats dc(user) as user_count by host

the problem is it does not count the current user since there's log off events. hope I explained that clearly. Thanks.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What is EventCode 4624? Is that a log on, a log off or either? If it is either, how do you distinguish between the two? If it is one or the other, which events signify the other event? Essentially, how can you tell from your data when a user logs on and when they log off?

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...