How do you search for users logged in to multiple devices in a certain time period?

[jstump1972]

Fellow Splunkers,

I am working on a query to monitor our Active Directory logins, and I want to watch for users logging into multiple machines within 15 minutes as an example to watch for things like shared credentials amongst staff or the account that has been compromised. The current search I have is below, but it isn't quite right.

index=wineventlog earliest=-4h | timechart span=15m dc(Client_Address) AS client_address_count by user

[jcart11entergy · Accepted solution]

If you are wanting a table list to show by user and which machines are being logged into, you could try

index=wineventlog earliest=-4h | stats values(Client_Address) as client_ip, dc(Client_Address) AS client_address_count by user | table user, client_ip, client_address_count

[Vijeta]

what help you need in your query? Is it not working as expected?