Splunk Search

Help with searching command

drobles96
Engager

Hi Everyone! I'm having a stuff time trying to figure out a search command for this lab assignment. So I inputted in the search bar, (source=/var/log/auth.log session | top user) and I got the users and a count but not sure if thats the session count. I've tried other ones but don't seem to get the results I need. I need a search command that'll show the opened and closed sessions based on each user so I could create a pie chart showing that data. I'm currently a student in cybersecurity and I'm new to Splunk. Would appreciate the help. Thank you! 🙂

 

Screen Shot 2020-11-24 at 9.38.02 PM.png

 

Labels (6)
0 Karma
1 Solution

thambisetty
Super Champion

@drobles96 

The keywords you can use from auth.log for session open  is "session opened" and session close is "session closed"

open sessions based on user:

Option: 1 - The below query will give all users and their open sessions count and count will be sorted in descending order. you will see top count first

index=<foo>  source=<sourceyoumentionedabove> "session opened" | stats count by user | sort - count

Option:2 -  The below query will give you same but top by default limit number of rows to 10. To get unlimited users then you should specify top 0 user ( 0 is no limit). top 20 user ( top 20 users).

index=<foo>  source=<sourceyoumentionedabove> "session opened" | top 0 user

You can do same for session closed by just replacing "session opened" with "session closed"  in above queries.

————————————
If this helps, give a like below.

View solution in original post

thambisetty
Super Champion

@drobles96 

The keywords you can use from auth.log for session open  is "session opened" and session close is "session closed"

open sessions based on user:

Option: 1 - The below query will give all users and their open sessions count and count will be sorted in descending order. you will see top count first

index=<foo>  source=<sourceyoumentionedabove> "session opened" | stats count by user | sort - count

Option:2 -  The below query will give you same but top by default limit number of rows to 10. To get unlimited users then you should specify top 0 user ( 0 is no limit). top 20 user ( top 20 users).

index=<foo>  source=<sourceyoumentionedabove> "session opened" | top 0 user

You can do same for session closed by just replacing "session opened" with "session closed"  in above queries.

————————————
If this helps, give a like below.

View solution in original post

drobles96
Engager

Thank you very much!!

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.