Getting Data In

How do you search for users logged in to multiple devices in a certain time period?

jstump1972
New Member

Fellow Splunkers,

I am working on a query to monitor our Active Directory logins, and I want to watch for users logging into multiple machines within 15 minutes as an example to watch for things like shared credentials amongst staff or the account that has been compromised. The current search I have is below, but it isn't quite right.

index=wineventlog earliest=-4h | timechart span=15m dc(Client_Address) AS client_address_count by user
0 Karma
1 Solution

jcart11entergy
Engager

If you are wanting a table list to show by user and which machines are being logged into, you could try

index=wineventlog earliest=-4h | stats values(Client_Address) as client_ip, dc(Client_Address) AS client_address_count by user | table user, client_ip, client_address_count

View solution in original post

0 Karma

jcart11entergy
Engager

If you are wanting a table list to show by user and which machines are being logged into, you could try

index=wineventlog earliest=-4h | stats values(Client_Address) as client_ip, dc(Client_Address) AS client_address_count by user | table user, client_ip, client_address_count

View solution in original post

0 Karma

Vijeta
Influencer

what help you need in your query? Is it not working as expected?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!