List of user who have logged into Splunk in the last 30 days and what Apps/Indexes they accessed.

[aknsun]

Hi,
Looking to get some help with a query for the following.

List of user who have logged into Splunk in the last 30 days and what Apps/Indexes they accessed.

Thanks.

[gcusello · Accepted solution]

Hi aknsun,
to know the logged in Splunk users you have to run a search like this

index=_audit sourcetype = audittrail action="login attempt" 

To know the App accessed you can use something like this:

index=_internal sourcetype="splunk_web_access" method="GET" status="200" user!=-
| rex field=uri ".*\/app\/(?<app>[^\/]*)\/"

To correlate them, you could run something like this:

(index=_internal sourcetype="splunk_web_access" method="GET" status="200" user!=-) OR (index=_audit sourcetype = audittrail action="login attempt")
| rex field=uri ".*\/app\/(?<app>[^\/]*)\/"
| stats count BY user app

Ciao.
Giuseppe

[aknsun]

Thanks @gcusello. That worked.