Splunk Search

Search query for multiple login done by more than one pc

pinzer
Path Finder

Hi all, someone can tell me how to do this query on the search app?

multiple login done by more than one pc


Thanks to all that can help me

Tags (1)
0 Karma
1 Solution

bwooden
Splunk Employee
Splunk Employee

It will vary based on your sourcetype, field extractions, and definition of "multiple login done by more than one pc".

To search for users signing onto a single server multiple times, you might try something like:

"login successful" | stats count by uid, server | where count > 1

To search for one server that was accessed my multiple accounts:

"login successful" | stats count by server, uid | stats count by server | where count > 1

View solution in original post

0 Karma

bwooden
Splunk Employee
Splunk Employee

It will vary based on your sourcetype, field extractions, and definition of "multiple login done by more than one pc".

To search for users signing onto a single server multiple times, you might try something like:

"login successful" | stats count by uid, server | where count > 1

To search for one server that was accessed my multiple accounts:

"login successful" | stats count by server, uid | stats count by server | where count > 1
0 Karma

pinzer
Path Finder

all of this...not website

0 Karma

treinke
Builder

logins to what? Active Directory? A Widows computer? A *nix machine? A website?

There are no answer without questions
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...