Splunk Search

Search query for multiple login done by more than one pc

pinzer
Path Finder

Hi all, someone can tell me how to do this query on the search app?

multiple login done by more than one pc


Thanks to all that can help me

Tags (1)
0 Karma
1 Solution

bwooden
Splunk Employee
Splunk Employee

It will vary based on your sourcetype, field extractions, and definition of "multiple login done by more than one pc".

To search for users signing onto a single server multiple times, you might try something like:

"login successful" | stats count by uid, server | where count > 1

To search for one server that was accessed my multiple accounts:

"login successful" | stats count by server, uid | stats count by server | where count > 1

View solution in original post

0 Karma

bwooden
Splunk Employee
Splunk Employee

It will vary based on your sourcetype, field extractions, and definition of "multiple login done by more than one pc".

To search for users signing onto a single server multiple times, you might try something like:

"login successful" | stats count by uid, server | where count > 1

To search for one server that was accessed my multiple accounts:

"login successful" | stats count by server, uid | stats count by server | where count > 1
0 Karma

pinzer
Path Finder

all of this...not website

0 Karma

treinke
Builder

logins to what? Active Directory? A Widows computer? A *nix machine? A website?

There are no answer without questions
0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...