Splunk Search

Help with searching command

drobles96
Engager

Hi Everyone! I'm having a stuff time trying to figure out a search command for this lab assignment. So I inputted in the search bar, (source=/var/log/auth.log session | top user) and I got the users and a count but not sure if thats the session count. I've tried other ones but don't seem to get the results I need. I need a search command that'll show the opened and closed sessions based on each user so I could create a pie chart showing that data. I'm currently a student in cybersecurity and I'm new to Splunk. Would appreciate the help. Thank you! 🙂

 

Screen Shot 2020-11-24 at 9.38.02 PM.png

 

Labels (6)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

@drobles96 

The keywords you can use from auth.log for session open  is "session opened" and session close is "session closed"

open sessions based on user:

Option: 1 - The below query will give all users and their open sessions count and count will be sorted in descending order. you will see top count first

index=<foo>  source=<sourceyoumentionedabove> "session opened" | stats count by user | sort - count

Option:2 -  The below query will give you same but top by default limit number of rows to 10. To get unlimited users then you should specify top 0 user ( 0 is no limit). top 20 user ( top 20 users).

index=<foo>  source=<sourceyoumentionedabove> "session opened" | top 0 user

You can do same for session closed by just replacing "session opened" with "session closed"  in above queries.

————————————
If this helps, give a like below.

View solution in original post

thambisetty
SplunkTrust
SplunkTrust

@drobles96 

The keywords you can use from auth.log for session open  is "session opened" and session close is "session closed"

open sessions based on user:

Option: 1 - The below query will give all users and their open sessions count and count will be sorted in descending order. you will see top count first

index=<foo>  source=<sourceyoumentionedabove> "session opened" | stats count by user | sort - count

Option:2 -  The below query will give you same but top by default limit number of rows to 10. To get unlimited users then you should specify top 0 user ( 0 is no limit). top 20 user ( top 20 users).

index=<foo>  source=<sourceyoumentionedabove> "session opened" | top 0 user

You can do same for session closed by just replacing "session opened" with "session closed"  in above queries.

————————————
If this helps, give a like below.

drobles96
Engager

Thank you very much!!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...