How to search for which users were logged in to a machine at a certain time or date on linux given the workstation name ?

[ibrahima]

I have the workstation name and IP address — how do I find out which users were logged in to the machine (Linux) and Windows, if possible?

[richgalloway]

What data from that machine does Splunk have? Are you indexing the audit log? Maybe the 'who' command from the Linux TA? It's hard to answer this question without knowing what there is to work with.

[ibrahima]

Yes I am indexing audit logs.