Splunk Search

How to create a search with several events from one host with different condition?

bosseres
Contributor

Hello, everyone

I need help from community.

I want to make search that will find two+ events from same host, for example user=David action=success AND user=Mike, but this events must be only on one host.
Thank you in advance.

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @bosseres,

sorry but your requrest isn't so clear:

do you want to find the users that have logins to more hosts or hosts with logins from more users?

Anyway, the approach is the same, the change is in the use of fields:

multiple user logins for the same host

your_search
| stats dc(users) AS dc_users values(users) As users BY host
| where dc_users>1

multiple hosts for the same user

your_search
| stats dc(host) AS dc_host values(host) As host BY user
| where dc_host>1

In general I hint to follow the Splunk Search Tutorial (https://docs.splunk.com/Documentation/Splunk/8.2.6/SearchTutorial/WelcometotheSearchTutorial) to understand how to create a search in Splunk.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...