Splunk Search

How to search the top 5 distinct users per day in the last 7 days?

New Member

Hello Everyone
I'm a new user.
I would like to search the top 5 user logfail distinct by day in the last 7 days.
I wrote the search below, but I receive the top 5 users in the 7 days (one table with 5 rows), but not distinct per day (one table with 35 rows).
Could you help me?
Thank you in advance

|tag="WINDOWS" (Logon_Type="2" OR Logon_Type="3" OR Logon_Type="7" OR Logon_Type="10") tag=LOGFAIL | eval User_Name=mvindex(User_Name, -1) | eval User_lower=lower(User_Name) | eval Event_day=strftime(_time, "%Y-%m-%d" )| top 5 Event_day User_Name | sort -Event_day
Tags (3)
0 Karma
1 Solution

Influencer

See if this works


|tag="WINDOWS" (LogonType="2" OR LogonType="3" OR LogonType="7" OR LogonType="10") tag=LOGFAIL | eval UserName=mvindex(UserName, -1) | eval Userlower=lower(UserName) | eval Eventday=strftime(time, "%Y-%m-%d" )|stats count by Eventday UserName | sort -Eventday, -count | dedup 5 Eventday

View solution in original post

0 Karma

Builder

To get the distinct values,
you can use the dedup functionality,

| dedup User_name

You could also look at the timewrap function, https://apps.splunk.com/app/1645/

This allows you to view on a daily/weekly basis

Hope this helps 🙂

0 Karma

Influencer

See if this works


|tag="WINDOWS" (LogonType="2" OR LogonType="3" OR LogonType="7" OR LogonType="10") tag=LOGFAIL | eval UserName=mvindex(UserName, -1) | eval Userlower=lower(UserName) | eval Eventday=strftime(time, "%Y-%m-%d" )|stats count by Eventday UserName | sort -Eventday, -count | dedup 5 Eventday

View solution in original post

0 Karma

New Member

Hello
now I would like in visualization one stack with the 5 user per day but at the moment I have 5 stack with a single userid per day(35 single stack). I've selected "stack" in the visualization panel but doesn't work.
What I've to do?

0 Karma