Splunk Search

How can I generate a report of users and machine usage by machine name?

jcftx7
New Member

I am looking at a log of users logging into machines. The two fields I am interested in are: Username and Machine name.

What I am trying to get my report to look like is a list of usernames, with machine names and a count of the records per machine.
Hoping for something like this...

Bob Smith:
Machine 1 - 16 times
Machine 2 - 2 times
Machine 3 - 6 times
Sam Jones:
Machine1 - 3 times
Machine2 - 1 time

etc....

Right now I have stats count by Username, MachineName | sort - count
And I am lost at this point as to how to change the query to format the way I need it..
Thanks for your help!

0 Karma

tmarlette
Motivator

So people will probably need a bit more information in order to answer this question.

This means adding details like:
1. windows or Linux or manufacture / appliance name
2. a pasted login event from your logs
3. your full search query syntax from start to finish

I'm not sure which OS or Log Type your looking at to know if your seeing login events, or connection events, or file copy events or what. There's a whole slew of login types that we're just gonna overlook here to see if I can help get you something that can work.

Assuming you have a perfect log that clarly says 'host=blah user=blah action=Login' and all of those fields are extracted properly, or something of the sort, you could try this:

<my_root_search_here> action=Login | stats count by UserName MachineName | sort - count

That should give you a table output.

0 Karma
Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...