Splunk Search
Highlighted

Search query for multiple login done by more than one pc

Path Finder

Hi all, someone can tell me how to do this query on the search app?

multiple login done by more than one pc


Thanks to all that can help me

Tags (1)
0 Karma
Highlighted

Re: Search query for multiple login done by more than one pc

SplunkTrust
SplunkTrust

logins to what? Active Directory? A Widows computer? A *nix machine? A website?

0 Karma
Highlighted

Re: Search query for multiple login done by more than one pc

Path Finder

all of this...not website

0 Karma
Highlighted

Re: Search query for multiple login done by more than one pc

Splunk Employee
Splunk Employee

It will vary based on your sourcetype, field extractions, and definition of "multiple login done by more than one pc".

To search for users signing onto a single server multiple times, you might try something like:

"login successful" | stats count by uid, server | where count > 1

To search for one server that was accessed my multiple accounts:

"login successful" | stats count by server, uid | stats count by server | where count > 1

View solution in original post

0 Karma