Splunk Search

Search for users Splunk login activity for * days

crlunde
Loves-to-Learn Everything

Hello,

I'm trying to search Splunk for user activity pertaining to logging into Splunk for X # of days. Everything I've tried so far returns some results but not all.  I've searched the _audit index as well as |rest /services/authentication/httpauth-tokens | fields userName, timeAccessed |dedup userName sortby timeAccessed. 

Does anyone have a search for this or a dashboard that would pull this information?

I need:

user, date last accessed at a minimum.

 

Thanks,

Craig

 
 

 

 
 
Labels (4)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

something like this

index = _audit user="*" action="login attempt" info=succeeded
| stats count values(_time) as lTimes by users
| convert ctime(lTimes) as loginTimes

r. Ismo  

0 Karma

crlunde
Loves-to-Learn Everything

Thank you for your response. 

Unfortunately that query didn't pull any data.

I can get user / last logon date using this query but cannot pull data for older dates.

| rest /services/authentication/httpauth-tokens | fields userName, timeAccessed | dedup suerName sort by timeAccessed

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...