Splunk Search

Return First user and _time from ACS syslog

buldamoosh
New Member

Firstly, my data is formatted like this:

Dec 15 13:58:12 gthou-nsacs01p CisACS_01_PassedAuth ne8yfimc 1 0 Message-Type=Authen OK,User-Name=Adorton,NAS-IP-Address=10.71.11.7,Caller-ID=174.253.112.223,NAS-Port=124190720,Group-Name=VPN Neudesic,Filter Information=No Filters activated.,AAA Server=gthou-nsacs01p,Network Device Group=Wireless and VPN,Access Device=phe-ardmore-int-sa00-rad,

I've created an eventtype which keys on "Message-Type=Authen OK" called acs-authentication-success. The query I'm working off of looks like this:

eventtype=acs-authentication-success | uniq User_Name | sort User_Name, -_date | fields User_Name, _time

However, rather than displaying the latest time that every User_Name was seen in the syslog data, it returns EVERY individual instance. I'm new to splunk reporting and would appreciate any assistance. Thanks in advance!

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

First, do not use uniq. I don't even know why it even exists. Try:

eventtype=acs-authentication-success | dedup User_Name | fields User_Name, _time

or

eventtype=acs-authentication-success | stats latest(_time) by User_Name

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

First, do not use uniq. I don't even know why it even exists. Try:

eventtype=acs-authentication-success | dedup User_Name | fields User_Name, _time

or

eventtype=acs-authentication-success | stats latest(_time) by User_Name
0 Karma

buldamoosh
New Member

Awesome, that definitely got my results as I expected them. Thank you so much! Can you point me to a document that will help me to export the dataset to a CSV with the User_name and the _time?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...