Hi! im trying to detect multiple user access from the same source (same mobile device). Im feeding splunk with logs from a mobile app like this:
09:50:14,524 INFO [XXXXXXXXXXXX] (default task-XXXXXX) [ authTipoPassword=X, authDato=XXXXX, authTipoDato=X, nroDocEmpresa=X, tipoDocEmpresa=X, authCodCanal=XXX, authIP=XXX.XXX.XXX.XXX, esDealer=X, dispositivoID=XXXXXXXXXX, dispositivoOS=XXXXX ]
im using the following search
search XXXX | stats dc(authDato) as count,values(authDato) as AuthDato by dispositivoID dispositivoOS authIP | where count > 1 | sort - count
and get almost all the info i wanted (like two different users - authDato - from same deviceID (dispositivoID), but i would like to enrich the data with the last time of ocurrence for the event.
Is there a way to include this information?
Thanks in advance.
Thanks! how can i get the value of "latest" on the results?
The table shows only
dispositivoID dispositivoOS authIP Country City count AuthDato
is it possible to get the latest time next to AuthDato?
Hi @dieguiariel,
latest is the value of the timestamp of the latest event of each group of values.
If you don't see it in your results, please share your search because, using my search it's present.
Ciao.
Giuseppe
hi sorry i didnt explain myself correctly, it shows the lasttime of lastocurrence of the grouped events, but i will like to show the last time of ocurrence of every item on the grouped list like this:
include the lastest time of ocurrence for 3546316, the latest time of 6320818 and so on.
dispositivoID dispositivoOS authIP count AuthDato latest
062FC4DB-034D-4CA3-B6BD-72C5A471F0AA | iOS | XXX.XXX.XXX.XXX | 3 | 3546319 6320818 7154705 | 2023-01-31 18:59:37 2023-01-31 17:45:36 2023-01-31 16:32:24 |
Hi @dieguiariel,
you could add the latest option to ths tats command:
search XXXX
| stats
dc(authDato) AS count
values(authDato) AS AuthDato
latest(_time) AS latest
BY dispositivoID dispositivoOS authIP
| where count > 1
| sort - count
| eval latest=strftime(latest,"%Y-%m-%d %H:%M:%S")
Ciao.
Giuseppe