Splunk Search

Return First user and _time from ACS syslog

buldamoosh
New Member

Firstly, my data is formatted like this:

Dec 15 13:58:12 gthou-nsacs01p CisACS_01_PassedAuth ne8yfimc 1 0 Message-Type=Authen OK,User-Name=Adorton,NAS-IP-Address=10.71.11.7,Caller-ID=174.253.112.223,NAS-Port=124190720,Group-Name=VPN Neudesic,Filter Information=No Filters activated.,AAA Server=gthou-nsacs01p,Network Device Group=Wireless and VPN,Access Device=phe-ardmore-int-sa00-rad,

I've created an eventtype which keys on "Message-Type=Authen OK" called acs-authentication-success. The query I'm working off of looks like this:

eventtype=acs-authentication-success | uniq User_Name | sort User_Name, -_date | fields User_Name, _time

However, rather than displaying the latest time that every User_Name was seen in the syslog data, it returns EVERY individual instance. I'm new to splunk reporting and would appreciate any assistance. Thanks in advance!

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

First, do not use uniq. I don't even know why it even exists. Try:

eventtype=acs-authentication-success | dedup User_Name | fields User_Name, _time

or

eventtype=acs-authentication-success | stats latest(_time) by User_Name

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

First, do not use uniq. I don't even know why it even exists. Try:

eventtype=acs-authentication-success | dedup User_Name | fields User_Name, _time

or

eventtype=acs-authentication-success | stats latest(_time) by User_Name
0 Karma

buldamoosh
New Member

Awesome, that definitely got my results as I expected them. Thank you so much! Can you point me to a document that will help me to export the dataset to a CSV with the User_name and the _time?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...