Splunk Search

How to review how many servers a user logged into within a specific time period

rcastello
Explorer

Hello,

How can I compile a stats list of what servers a user account has logged into within a specific time period? I was surprised I couldn't find a similar answer that solved this.

Thank you.

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @rcastello,
try something like this (for Windows Operative Systems):

index=wineventlog EventCode=4624
| stats values(host) AS host count BY Account_name

in this way you have a list of hosts for each user.

If instead you want to search a specific account, you could run something like this

index=wineventlog EventCode=4624 Account_name="xxxxxxxx"
| stats count BY host

that you can insert in a dashboard.

In both cases, check the name of the field Account_name because it could be different in your Windows (e.g. in Italy is frequently Nome_account).

Ciao.
Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @rcastello,
try something like this (for Windows Operative Systems):

index=wineventlog EventCode=4624
| stats values(host) AS host count BY Account_name

in this way you have a list of hosts for each user.

If instead you want to search a specific account, you could run something like this

index=wineventlog EventCode=4624 Account_name="xxxxxxxx"
| stats count BY host

that you can insert in a dashboard.

In both cases, check the name of the field Account_name because it could be different in your Windows (e.g. in Italy is frequently Nome_account).

Ciao.
Giuseppe

0 Karma
Get Updates on the Splunk Community!

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...