How can I create a search to run a report on Administrator Accounts that are used to access the internet?

[Onuorahc]

How can I create a search to run a report on Administrator Accounts that are used to access the internet

[woodcock]

OK, try something like this:

sourcetype=bluecoat account_name="SA*" | stats count latest(_time) AS LastAccess by account_name

[tskinnerivsec]

We need to know what types of logs you have available. If you have authenticated proxy logs, they would be helpful. Some firewalls provide authentication information as well, such as Palo Alto firewalls. The most common source of logs for this type of reporting are proxy logs.

[woodcock]

There is no way to answer this question without MUCH more context. What logs do you have? Is there a way to distinguish "administrator"?

[Onuorahc]

Yes, there is bluecoat proxy log...

[Onuorahc]

Syslog and each account name has: "SA" before it. Eg., "SAlun031"