Splunk Search

Help with searching command

drobles96
Engager

Hi Everyone! I'm having a stuff time trying to figure out a search command for this lab assignment. So I inputted in the search bar, (source=/var/log/auth.log session | top user) and I got the users and a count but not sure if thats the session count. I've tried other ones but don't seem to get the results I need. I need a search command that'll show the opened and closed sessions based on each user so I could create a pie chart showing that data. I'm currently a student in cybersecurity and I'm new to Splunk. Would appreciate the help. Thank you! 🙂

 

Screen Shot 2020-11-24 at 9.38.02 PM.png

 

Labels (6)
0 Karma
1 Solution

thambisetty
SplunkTrust
SplunkTrust

@drobles96 

The keywords you can use from auth.log for session open  is "session opened" and session close is "session closed"

open sessions based on user:

Option: 1 - The below query will give all users and their open sessions count and count will be sorted in descending order. you will see top count first

index=<foo>  source=<sourceyoumentionedabove> "session opened" | stats count by user | sort - count

Option:2 -  The below query will give you same but top by default limit number of rows to 10. To get unlimited users then you should specify top 0 user ( 0 is no limit). top 20 user ( top 20 users).

index=<foo>  source=<sourceyoumentionedabove> "session opened" | top 0 user

You can do same for session closed by just replacing "session opened" with "session closed"  in above queries.

————————————
If this helps, give a like below.

View solution in original post

thambisetty
SplunkTrust
SplunkTrust

@drobles96 

The keywords you can use from auth.log for session open  is "session opened" and session close is "session closed"

open sessions based on user:

Option: 1 - The below query will give all users and their open sessions count and count will be sorted in descending order. you will see top count first

index=<foo>  source=<sourceyoumentionedabove> "session opened" | stats count by user | sort - count

Option:2 -  The below query will give you same but top by default limit number of rows to 10. To get unlimited users then you should specify top 0 user ( 0 is no limit). top 20 user ( top 20 users).

index=<foo>  source=<sourceyoumentionedabove> "session opened" | top 0 user

You can do same for session closed by just replacing "session opened" with "session closed"  in above queries.

————————————
If this helps, give a like below.

drobles96
Engager

Thank you very much!!

0 Karma
Get Updates on the Splunk Community!

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...