Other Usage

How to get current user from windows server (with username and count)?

sam_kwon
Explorer

I'm using this code which gives me the information but I need current total users 

 

(index=* OR index=_*) (index=* OR index=_*) index=wineventlog "ComputerName=sample_server" "EventCode=4624" | fields "_time", "user" | dedup "user" 

(JFI -- I USED 15 MIN TIME FRAME)

Labels (1)
Tags (2)

sam_kwon
Explorer

ok  make sense!

I read somewhere by using substring you can get the info. 

 

bowesmana
SplunkTrust
SplunkTrust

You have 3 odd index=... statements at the start in that you are searching *, _* and wineventlog. I suspect you just want index=wineventlog.

If you just want a count of the unique number of users in your search window, do this

index=wineventlog "ComputerName=sample_server" "EventCode=4624" 
| stats dc(user) as user_count

 

sam_kwon
Explorer

actually I want current user so, I don't know event log work...

 

is there any other command to use to get current user in rdp or server 

PickleRick
SplunkTrust
SplunkTrust

Splunk does not work this way. You only analyze what data you have pushed from the forwarders. In case of windows you get login events, logout events. You can try to deduce from that who is currently logged in (for example by searching who logged in and hasn't logged out) but that's not checked directly at the source and is not a 100%-proof method (for example, if a user logged in but then the windows box crashed and had no means of logging a logout event you'll never know that the user is no longer logged in. You could have a scripted/modular input listing periodically users logged in at a given moment but that you'd have to create yourself.

Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...