Splunk Search

Creating a detailed table to investigate user account logging into several servers

Explorer

Hello,

I'm attempting to build a detailed table complete with timestamp, account name, eventcode, and host. We found that there is an account logging into various servers over a period of 48 hours, but I'm having difficulty creating a proper query. The only column that is filled out is host. Here is what I attempted:

index="index" Account_Name="account" EventCode="event code" | stats count BY host | eval timestamp=strftime(_time, "%B %d, %D:%M:%S %p") | table timestamp Account_Name host eventcode

Thank you for any help the community can provide.

0 Karma

Ultra Champion
index="index" Account_Name="account" EventCode="event code" 
| stats count last(_time) as _time by Account_Name host EventCode
| eval timestamp=strftime(_time, "%B %d, %H:%M:%S %p")
| table timestamp Account_Name host EventCode

Hi, @rcastello
Is this result what you want to know?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!