Splunk Search

How to find which hosts a particular user has logged in to?

br0dy
New Member

I'm trying to find which hosts a particular user has logged in to. I have the user's name, but I cannot figure out the systems they have used.

0 Karma

jtsplunk
Splunk Employee
Splunk Employee

Have you tried creating a table with the username and host field? The field name for username, login message, and host may differ in your situation.

Example:
'Successful-login-message' | table _time username host

0 Karma

br0dy
New Member

I have not tried that yet. Thank you for the suggestion.

0 Karma
Get Updates on the Splunk Community!

ATTENTION!! We’re MOVING (not really)

Hey, all! In an effort to keep this Slack workspace secure and also to make our new members' experience easy, ...

Splunk Admins: Build a Smarter Stack with These Must-See .conf25 Sessions

  Whether you're running a complex Splunk deployment or just getting your bearings as a new admin, .conf25 ...

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...