Getting Data In

How to search Windows security logs to find unique users (username) who have logged during a give time frame?

steveg126
Engager

Hi All and thanks in advance,

I am currently using Splunk to grab a server's security logs. I would like to run a search to find out the unique users who log in a month or during a given time. Ideally I would be able to get the username of the user. Is this possible? All I can see from research is that I will need to use the distinct count function(DC).

If you have any questions please let me know. I am grateful for all advice given.

Thanks,

SG

hortonew
Builder

You can do something like:

<search> | stats count by username

Or:

<search> | dedup username | table username

steveg126
Engager

Neither commands seemed to show up anything. I have now got up to host="DC01-DEV" Account_Name="*" this seems to show up all the ones but you then have to expand each one to show account name. Also this is not unique account names. How would I make it so it purely lists the users and I do not have to expand this?

Thanks,

SG

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...