Splunk Search

Events coming along with user when using top, rare?

jahziah952
Engager

Hi 

When i'm searching the top users who logged into a host, I'm getting event data along with the user when i'm using pipe.

ex: sourcetype="hostname" "authentication success" | top limit=50 Usersplunk top.JPG

 

Can someone help with this issue?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jahziah952,

this means that there's an error in field extraction.

the field extraction you're using sometimes doesn't take the correct value, analyze your regex.

I can help you in regex debugging if you can share two kinds of samples. one or two correct events and one or two not correct events.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...