Splunk Search

Help with searching command

drobles96
Engager

Hi Everyone! I'm having a stuff time trying to figure out a search command for this lab assignment. So I inputted in the search bar, (source=/var/log/auth.log session | top user) and I got the users and a count but not sure if thats the session count. I've tried other ones but don't seem to get the results I need. I need a search command that'll show the opened and closed sessions based on each user so I could create a pie chart showing that data. I'm currently a student in cybersecurity and I'm new to Splunk. Would appreciate the help. Thank you! 🙂

 

Screen Shot 2020-11-24 at 9.38.02 PM.png

 

Labels (6)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

@drobles96 

The keywords you can use from auth.log for session open  is "session opened" and session close is "session closed"

open sessions based on user:

Option: 1 - The below query will give all users and their open sessions count and count will be sorted in descending order. you will see top count first

index=<foo>  source=<sourceyoumentionedabove> "session opened" | stats count by user | sort - count

Option:2 -  The below query will give you same but top by default limit number of rows to 10. To get unlimited users then you should specify top 0 user ( 0 is no limit). top 20 user ( top 20 users).

index=<foo>  source=<sourceyoumentionedabove> "session opened" | top 0 user

You can do same for session closed by just replacing "session opened" with "session closed"  in above queries.

————————————
If this helps, give a like below.

View solution in original post

thambisetty
SplunkTrust
SplunkTrust

@drobles96 

The keywords you can use from auth.log for session open  is "session opened" and session close is "session closed"

open sessions based on user:

Option: 1 - The below query will give all users and their open sessions count and count will be sorted in descending order. you will see top count first

index=<foo>  source=<sourceyoumentionedabove> "session opened" | stats count by user | sort - count

Option:2 -  The below query will give you same but top by default limit number of rows to 10. To get unlimited users then you should specify top 0 user ( 0 is no limit). top 20 user ( top 20 users).

index=<foo>  source=<sourceyoumentionedabove> "session opened" | top 0 user

You can do same for session closed by just replacing "session opened" with "session closed"  in above queries.

————————————
If this helps, give a like below.

drobles96
Engager

Thank you very much!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...