log on times for report

[joeyfine]

Hello all,

I am creating a report that shows that shows when external facing ips log into our server. I have the user name, IP address, City, Region, & Country all reporting. I am trying to get a time stamp when the users log in but i cannot find the right command can you help? Here is what I have so far..

sourcetype="iis" source="E:\TempSplunkData\IIS\u_ex15012812.log" c_ip != "10.47.*" | iplocation c_ip | table c_ip, cs_username, City, Region, Country

[richgalloway · Accepted solution]

... | table _time c_ip, cs_username, City, Region, Country

[joeyfine]

Thanks that worked 🙂