Getting Data In

How do you search for users logged in to multiple devices in a certain time period?

jstump1972
New Member

Fellow Splunkers,

I am working on a query to monitor our Active Directory logins, and I want to watch for users logging into multiple machines within 15 minutes as an example to watch for things like shared credentials amongst staff or the account that has been compromised. The current search I have is below, but it isn't quite right.

index=wineventlog earliest=-4h | timechart span=15m dc(Client_Address) AS client_address_count by user
0 Karma
1 Solution

jcart11entergy
Engager

If you are wanting a table list to show by user and which machines are being logged into, you could try

index=wineventlog earliest=-4h | stats values(Client_Address) as client_ip, dc(Client_Address) AS client_address_count by user | table user, client_ip, client_address_count

View solution in original post

0 Karma

jcart11entergy
Engager

If you are wanting a table list to show by user and which machines are being logged into, you could try

index=wineventlog earliest=-4h | stats values(Client_Address) as client_ip, dc(Client_Address) AS client_address_count by user | table user, client_ip, client_address_count

0 Karma

Vijeta
Influencer

what help you need in your query? Is it not working as expected?

0 Karma
Get Updates on the Splunk Community!

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...