Splunk Search

How to perform splunk search for local account in the openstack tenant (and audit) logs ?

LearningGuy
Motivator

How to perform splunk search for local account in the openstack tenant (and audit) logs ?
Thanks

Labels (4)
0 Karma

LearningGuy
Motivator

I need to extract local user account from syslog messages on unix audit.log. For example: "message": type=USER_ACCT msg=audit(some number)....      acct=...     etc etc      Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

This isn't what I asked for and isn't very useful - I do not have the benefit of seeing your data or be familiar with the log you mentioned, so in order to help you, you are going to need to help me by providing anonymised examples of the log events (preferably in a code block </> so that formatting is preserved).

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Please share some (anonymised) sample log events which you have ingested into Splunk, preferably in a code block </> to preserve formatting and spaces.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...