Security

First Day of Login / Last Day of Login in a month

New Member

Here is the scenario:

We want to know the first day of login and the last day of login in a month for a particular user.

Please help me.

Tags (2)
0 Karma

Builder
stats first(_time) last(_time) count(eventid) by eventid,snarehost,access,username

note that in Splunk, first is last and last is first

if you have the date of login extracted in a field, use that field instead of _time

0 Karma

Influencer

... pastebin?

0 Karma

New Member

yes sir..im unable to upload the excel outcome. Can you give ur email add so i can email to you the excel sheets. In order to be more clearer.

Thanks

0 Karma

Path Finder

If I understand properly, the excel file is your outcome, and what form has the input?
To find first/last occurrence of something I would use streamstats with first()/last() function.

0 Karma

New Member

Hi in the excel sheet there will be 4 column which will be Event ID, First Day of Login, Last Day of Login, User ID and Number of Events,

I manage to create the Event ID, User and Number of Events by using stats count by eventid,snarehost, access, username,

BUT I'm unable to include the First Time of login and the last login during the month query.

Hope you have a clear view on this. Thanks

0 Karma

Path Finder

Could you provide some more data? Maybe some example log data to work on?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!