How can i find a full list of Users using IP address

[robertlynch2020]

Hi

I have the below command that i think works 95% of the time.

index=_internal sourcetype=splunkd_ui_access | stats count by clientip , user , _time | lookup dnslookup clientip | timechart span=1d distinct_count(clienthost) by clienthost limit=100

The issues is sometime is reports users that did not use the system. I think this might be because of IP address changing. However i am not 100% about this.

Any help would be brill.

[horsefez]

Hi,

The issues is sometime is reports users that did not use the system. I think this might be because of IP address changing. However i am not 100% about this.

This doesn't sound right... how should splunk know about the names of other users that didn't access the instance??

[gcusello]

Hi robertlynch2020,
surely IP address changes because is assigned by a dns.
Anyway you could create a lookup with a list of all users.
You could maintain this lookup with a scheduled search or an extraction from Active Directory.
If you have this lookup you can check the users in your search and list the ones not present:

index=_internal sourcetype=splunkd_ui_access
| eval user=lower(user)
| stats count BY user
| append [ | inputlookup user_lookup.csv | eval user=lower(user), count=0 | fields user count ]
| stats sum(count) AS Total by user

In this way users with Total=0 are missed and users with Total greater than 0 are present.

Bye.
Giuseppe