Splunk Search

Creating Bar Chart for SSH logs

akashjohn
Explorer

Hi Team,

We are trying to create a bar chart from secure log. The ultimate goal is to plot the accounts (top 10) used to login to maximum number of servers with count. i.e. the accounts which were used to log into multiple servers. From basic query we were are getting an output as shown below,
alt text

We are planning to plot server details (pup-ofc-mar-hjn-a) on X - Axis and users on Y - Axix. Could you please let us know how can we achieve this?

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

I think that you already loaded logs in an index (e.g.: secure_logs) and extracted the requested fields (user, account, etc...).
Than you have to write a search as the following
index=secure_logs | top users
or
index=secure_logs | stats dc(host) by users | head 10

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

I think that you already loaded logs in an index (e.g.: secure_logs) and extracted the requested fields (user, account, etc...).
Than you have to write a search as the following
index=secure_logs | top users
or
index=secure_logs | stats dc(host) by users | head 10

Bye.
Giuseppe

akashjohn
Explorer

Hi Giuseppe,

Thanks for the response. we can fetch the data with the quires, but here the requirement is to plot the accounts (top 10) used to login to maximum number of servers with count. i.e. the accounts which were used to log into multiple servers.

That means we need to fetch the users which are login to multiple servers and need to find the count of servers. The query which you have mentioned is not seems to be working in this case.

0 Karma

gcusello
SplunkTrust
SplunkTrust

with this search you have the number of distict server accessed by each user.

Sorry I forgot to insert sort!
index=secure_logs | stats dc(host) AS hosts by users | sort -hosts | head 10

Bye.
Giuseppe

akashjohn
Explorer

Thanks Giuseppe, it seems to be working for me.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...