Security

I have many users but they all user the same ID to log in. Is there anyway to tell them apart from the IP address of there PC, or something like that?

robertlynch2020
Influencer

I have used this
index=_audit action="login attempt" "info=succeeded" | stats count by action , user , _time | timechart span=1d count by user

But all the users get put into the same bucket.

Tags (1)
0 Karma

PPape
Contributor

this shows you the actions by user and IP

index=_internal sourcetype=splunkd_ui_access | stats count by clientip , user , _time | eval UserIP=user+" - "+clientip | timechart span=1d count by UserIP
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...