Monitoring Splunk

Can you help us find web GUI log in attempts from index=_audit?

stwong
Communicator

Hi,

We're looking for web GUI log in attempts from index=_audit. Note that for event like following:

Audit:[timestamp=12-20-2018 12:15:38.921, user=user123, action=login attempt, info=succeeded, src=12.34.56.78][n/a]

the "action" field is set to "success" instead of "login attempt".

Was it set somewhere? Sorry for the newbie question.

Thanks a lot.
Regards

EDIT: removed the ip address

Tags (2)
0 Karma
1 Solution

dkeck
Influencer

Hi,

could be that someone created a field extraction for audittrail to change the value to "success", since its not the default value.

You should check that, for example in "All configurations" or you could grep on the UI in directory $SPLUNK_HOME/etc/users for the word action command: grep -R action

View solution in original post

dkeck
Influencer

Hi,

could be that someone created a field extraction for audittrail to change the value to "success", since its not the default value.

You should check that, for example in "All configurations" or you could grep on the UI in directory $SPLUNK_HOME/etc/users for the word action command: grep -R action

stwong
Communicator

Thanks. Found that it's done by a transform in the CIM add-on $SPLUNKE_HOME/etc/apps/Splunk_SA_CIM/default/props.conf.

Thanks a lot.

0 Karma

inventsekar
Super Champion

i hope the info=succeeded is what you are looking for:
Audit:[timestamp=12-20-2018 12:15:38.921, user=user123, action=login attempt, info=succeeded, src=12.34.56.78][n/a]

index="_audit" action=*login*

my question on this same topic:
https://answers.splunk.com/answers/686177/is-there-a-splunk-account-lockout-for-users-if-you.html

As you are a new user to Splunk Answers, you can upvote the answers/comments,
if this answer resolved your query, you can select this answer and "accept" it as the answer, so that this question will be moved to answered queue. Happy Splunking!

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.

stwong
Communicator

Hi, thanks for your help.
I'm just interest to know which configuration makes Splunk changed value of "action" into something different to that stated in the events...

0 Karma

inventsekar
Super Champion

I'm just interest to know which configuration makes Splunk changed value of "action" into something different to that stated in the events...
i think there are no configurations. It is just the audit log format Splunk developers selected.

there are only 2 choices:
action=login attempt, info=succeeded
action=login attempt, info=failed

PS ... If any post helped you in any way, pls give a hi-five to the author with an upvote. if your issue got resolved, please accept the reply as solution.. thanks.
0 Karma

stwong
Communicator

Thanks and agree. But when expanding the event fields on web interfrace, we can see that the "action" attribute is set to "success", not "login attempt".

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...