Splunk Search

SPL to find first time account access

corecomputetool
New Member

To find the user first time login in PCI compilance - what is the SPL query ?

I am using the query as below :

| from inputlookup:access_tracker | stats min(firstTime) as firstTime,values(dest) as dest by user | sort 100 - firstTime | uitime(firstTime) | fields dest user firstTime

Tags (1)
0 Karma

Adrian_ftx
Path Finder

Hi,

Can you provide a sample of your data and the expected result please?
Can you share the return of your SPL request too please?

Best regards,
Adrian

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...