Login connections made to splunk

[akarivaratharaj]

I would like to fetch No. of logins on Splunk (how frequently my splunk is being accessed). It is basically, how many connections are made to splunk for indexing/searches.

I am unaware where this information will be available on Splunk. Could anyone please help me to know , how and where can I get this information.

[mayurr98]

Hi

Have a look at this answer
https://answers.splunk.com/answers/424284/how-to-get-the-number-of-logins-per-user-for-the-p.html

let me know if this helps!

[akarivaratharaj]

Hi @mayurr98,

Thankyou for your quick response. I have referred the above link which you shared.

In that post they have mentioned the below query to find the number of logins made to Splunk.
"index=_audit info=succeeded action="login attempt" | stats count by user"

This query is giving only the count of logins which are made by splunk users. It is good enough. But in addition to this, I need the login attempts made by other servers/databases also. For example, I have setup a forwarder in Host X. All the required log details from the host X is forwarded to my splunk instance and index over there. So while indexing also, my splunk is been accessed by the host/forwarder. I would like to have that information also.

How about the logs available in "sourcetype=WinEventLog:Security"? I have referred some posts, where people were discussing about the EventCode 4625 or 4624 (login success/failure).

Any idea where can I get those logs too?

[mayurr98]

Hi well the link i have shared will give you info about only splunk as splunk by default stores internal logs like audit,introspection,etc. In order to index the remote host logs you would need to monitor those files.
In order to monitor windows event logs data refer this:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/MonitorWindowseventlogdata