Splunk Enterprise Security

Unique Users logged into host

GenericSplunkUs
Path Finder

I've got a search that's using two stats commands and I'm trying to find a way to get the same results without doubling up on the stats command. I've been searching for answers but I guess I'm not using the right keywords.

What I've got.
index=windowseventlogs EventID="4625" OR EventID="4776" OR EventID="4624" OR EventID="4777" AND NOT user="-" | stats count by user, host | stats count as user by host

Is there a better way to get this same result? I want to be able to list how many unique users logged into the host.

Thanks

0 Karma
1 Solution

adonio
Ultra Champion

maybe ... | stats dc(user) as unique_users values(user) as list_of_users count as total_logged_attempt by host ?

View solution in original post

0 Karma

adonio
Ultra Champion

maybe ... | stats dc(user) as unique_users values(user) as list_of_users count as total_logged_attempt by host ?

0 Karma

GenericSplunkUs
Path Finder

This is much better, thank you.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...