Splunk Enterprise Security

how to compare successful logins in the host with yesterday's

satyaallaparthi
Path Finder

Hello,

I am getting successful logins from each server which is like 4000 per day from Each server. But some days that number is going high.
How can I compare successful logins with yesterday and how to get the difference between yesterday and today?

and create a notable event which is more than normal logins by comparing 2.

Any help would be appreciated!

Thanks,

0 Karma
1 Solution

mayurr98
Super Champion

Try this logic :

index=_internal earliest=-1d@d latest=now 
| timechart count span=1d 
| timewrap d 
| rename 1day_before as Yesterday latest_day as Today 
| eval diff=Yesterday-Today

View solution in original post

mayurr98
Super Champion

Try this logic :

index=_internal earliest=-1d@d latest=now 
| timechart count span=1d 
| timewrap d 
| rename 1day_before as Yesterday latest_day as Today 
| eval diff=Yesterday-Today
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>