Splunk Search

Creating Bar Chart for SSH logs

akashjohn
Explorer

Hi Team,

We are trying to create a bar chart from secure log. The ultimate goal is to plot the accounts (top 10) used to login to maximum number of servers with count. i.e. the accounts which were used to log into multiple servers. From basic query we were are getting an output as shown below,
alt text

We are planning to plot server details (pup-ofc-mar-hjn-a) on X - Axis and users on Y - Axix. Could you please let us know how can we achieve this?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

I think that you already loaded logs in an index (e.g.: secure_logs) and extracted the requested fields (user, account, etc...).
Than you have to write a search as the following
index=secure_logs | top users
or
index=secure_logs | stats dc(host) by users | head 10

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

I think that you already loaded logs in an index (e.g.: secure_logs) and extracted the requested fields (user, account, etc...).
Than you have to write a search as the following
index=secure_logs | top users
or
index=secure_logs | stats dc(host) by users | head 10

Bye.
Giuseppe

akashjohn
Explorer

Hi Giuseppe,

Thanks for the response. we can fetch the data with the quires, but here the requirement is to plot the accounts (top 10) used to login to maximum number of servers with count. i.e. the accounts which were used to log into multiple servers.

That means we need to fetch the users which are login to multiple servers and need to find the count of servers. The query which you have mentioned is not seems to be working in this case.

0 Karma

gcusello
SplunkTrust
SplunkTrust

with this search you have the number of distict server accessed by each user.

Sorry I forgot to insert sort!
index=secure_logs | stats dc(host) AS hosts by users | sort -hosts | head 10

Bye.
Giuseppe

akashjohn
Explorer

Thanks Giuseppe, it seems to be working for me.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...