Splunk Search

How to use timechart to display failed user login info, sorted by time/date of each login attempt?

rkris
Explorer

I'm trying to display failed user login information by using a timechart but I'm not sure how to show the time and date of the logins for each of the user

This is my code :

source="General-linux-sql.log" AND sourcetype="Linux" AND "Failure Audit" AND "Logon "
| rex "User Name\: (?<User_Name>[^\s]+)"
| timechart count by User_Name

This is the output that I get. Also, how do I change it so that all the users are separated?

paste_qns.PNG

Labels (2)
0 Karma

rkris
Explorer

How do I display the time for each of the logins as well?

0 Karma

anilchaithu
Builder

@rkris 

you can do the following to see users

  • change area chart to line chart (OR) column chart
  • If you choose line chart, Format -> General -> Multi series mode -> yes

you can play with both chart type & format options to improve look and feel.

Hope this helps

rkris
Explorer

@anilchaithu 

Thanks for the solution! However, now I have another problem with the Y-axis title. The title is now unreadable even though I changed it. Do you have any fix for this?

paste_qns1.PNG

paste_qns2.PNG

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Have you tried trellis as visualization? It should work if you have less than 20 user and if more then you must divide those to  group of 20.

r. Ismo

0 Karma

rkris
Explorer
 
0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...