Splunk Search

How to monitor three users?

woodlandrelic
Path Finder

Hi 

My system is Linux.  Am trying to monitor 3 users in an index.  The last time they login, IP address etc. There are over 180+ user. How do I get the search to show just the three users I want e.g James Peter and John?

Thanks

Labels (1)
0 Karma
1 Solution

PaulPanther
Motivator

Hi @woodlandrelic 

if they fields for user, login time and IP address are already extracted you could set up a search like that

index=abc user IN (James,Peter,John)
|stats latest(login_time) by ip_address, user

View solution in original post

PaulPanther
Motivator

Hi @woodlandrelic 

if they fields for user, login time and IP address are already extracted you could set up a search like that

index=abc user IN (James,Peter,John)
|stats latest(login_time) by ip_address, user

woodlandrelic
Path Finder

@PaulPanther 

Thanks. I have another user am monitoring in another index. Is there a way to combine both or will have to save them as a report individually?

0 Karma

PaulPanther
Motivator

You could combine both indexes like

 

(index=abc OR index=def) user IN (James,Peter,John)
|stats latest(login_time) by ip_address, user

 

But that's a bit theoretical because I don't know if the data source  or format that you wanna search through is the same. Feel free to provide some more information about the events.

woodlandrelic
Path Finder

@PaulPanther 

Fantastic! It worked. I will find my way from here. Appreciate the quick help. Thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...