Other Usage

How to get current user from windows server (with username and count)?

sam_kwon
Explorer

I'm using this code which gives me the information but I need current total users 

 

(index=* OR index=_*) (index=* OR index=_*) index=wineventlog "ComputerName=sample_server" "EventCode=4624" | fields "_time", "user" | dedup "user" 

(JFI -- I USED 15 MIN TIME FRAME)

Labels (1)
Tags (2)

sam_kwon
Explorer

ok  make sense!

I read somewhere by using substring you can get the info. 

 

bowesmana
SplunkTrust
SplunkTrust

You have 3 odd index=... statements at the start in that you are searching *, _* and wineventlog. I suspect you just want index=wineventlog.

If you just want a count of the unique number of users in your search window, do this

index=wineventlog "ComputerName=sample_server" "EventCode=4624" 
| stats dc(user) as user_count

 

sam_kwon
Explorer

actually I want current user so, I don't know event log work...

 

is there any other command to use to get current user in rdp or server 

PickleRick
SplunkTrust
SplunkTrust

Splunk does not work this way. You only analyze what data you have pushed from the forwarders. In case of windows you get login events, logout events. You can try to deduce from that who is currently logged in (for example by searching who logged in and hasn't logged out) but that's not checked directly at the source and is not a 100%-proof method (for example, if a user logged in but then the windows box crashed and had no means of logging a logout event you'll never know that the user is no longer logged in. You could have a scripted/modular input listing periodically users logged in at a given moment but that you'd have to create yourself.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...