Pulling back data from users login in using SAML.

[CMAzurdia]

Hello Splunk team,

I need a search query that can pull data back of successful and unsuccessful login attempts of users login into a server using SAML. I also need to create a dashboard of the results. Any additional information needed, please let me know.

Do I need to extract a field of all the users using SAML?

v/r

cmazurdia

[CMAzurdia]

The query did not error, but also 0 events. Any other way? I have created a lookup table.

[CMAzurdia]

I have a server pushing audit logs data to a syslog, to login to the server you need SAML. My question is: how do I pull data of successful logins and unsuccessful logins of those SAML users in Splunk?

Thank you.

[livehybrid]

Hi @CMAzurdia 

My apologies, I thought you were referring to people logging in to Splunk using SAML.

Ultimately this depends on what the data looks like when you receive it in Splunk? Its worth starting by identifying key fields in your data and then filtering down until you just get the events you are interested in - from here you can work through your usecase/requirements.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[livehybrid]

Hi @CMAzurdia 

Typically success/failed login attempts are recorded by the Identity Provider (IdP) rather than Splunk, however you can see successful logins to Splunk from SAML users with the following query:

index=_internal method=POST uri=/saml/acs
| table _time user clientip

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing