Splunk Search

Creating a detailed table to investigate user account logging into several servers

rcastello
Explorer

Hello,

I'm attempting to build a detailed table complete with timestamp, account name, eventcode, and host. We found that there is an account logging into various servers over a period of 48 hours, but I'm having difficulty creating a proper query. The only column that is filled out is host. Here is what I attempted:

index="index" Account_Name="account" EventCode="event code" | stats count BY host | eval timestamp=strftime(_time, "%B %d, %D:%M:%S %p") | table timestamp Account_Name host eventcode

Thank you for any help the community can provide.

0 Karma

to4kawa
Ultra Champion
index="index" Account_Name="account" EventCode="event code" 
| stats count last(_time) as _time by Account_Name host EventCode
| eval timestamp=strftime(_time, "%B %d, %H:%M:%S %p")
| table timestamp Account_Name host EventCode

Hi, @rcastello
Is this result what you want to know?

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...