Splunk Search

How to split stats results into single line item for each event

SplunkLunk
Path Finder

Greetings,

I'm trying to find when a user logs (or tries to log) into six different workstations over the course of 24 hours. My current query looks like this:

index=[myindex] source=[mysource] Action=0 OR Action=1
|stats count(Terminal) as Workstation, values(Terminal) as Terminal, values(Action) as Action by Logon
|where mvcount(Terminal)>5

Action=0 is success, Action=1 is failure, and Logon is the username. I get the aggregate results that I want. For example, I can see that user "X" logged in eight times with six different workstations. Now I want to split each of those into their individual events. Then I can make a table with the time for each attempt with the respective workstation as well as include some other info about the event. I tried just adding a table command at the end but that didn't work. Can anyone tell me the best way to do what I'm asking? Thanks.

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

index=[myindex] source=[mysource] Action=0 OR Action=1
| eventstats dc(Terminal) as TerminalsUsed by Logon |where TerminalsUsed>5
| table _time Terminal Action Logon ...anyotherfieldyouneed...

View solution in original post

somesoni2
Revered Legend

Try like this

index=[myindex] source=[mysource] Action=0 OR Action=1
| eventstats dc(Terminal) as TerminalsUsed by Logon |where TerminalsUsed>5
| table _time Terminal Action Logon ...anyotherfieldyouneed...

SplunkLunk
Path Finder

Thanks. That works!

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...