Splunk Search

Search query for multiple login done by more than one pc

Path Finder

Hi all, someone can tell me how to do this query on the search app?

multiple login done by more than one pc


Thanks to all that can help me

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

It will vary based on your sourcetype, field extractions, and definition of "multiple login done by more than one pc".

To search for users signing onto a single server multiple times, you might try something like:

"login successful" | stats count by uid, server | where count > 1

To search for one server that was accessed my multiple accounts:

"login successful" | stats count by server, uid | stats count by server | where count > 1

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

It will vary based on your sourcetype, field extractions, and definition of "multiple login done by more than one pc".

To search for users signing onto a single server multiple times, you might try something like:

"login successful" | stats count by uid, server | where count > 1

To search for one server that was accessed my multiple accounts:

"login successful" | stats count by server, uid | stats count by server | where count > 1

View solution in original post

0 Karma

Path Finder

all of this...not website

0 Karma

SplunkTrust
SplunkTrust

logins to what? Active Directory? A Widows computer? A *nix machine? A website?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!