Splunk Search

Splunk search that will find when customers first logged in?

jhilton90
Path Finder

I'm trying to come up with a Splunk search query that I can use to find when customers have first attempted to log in. We often get call outs regarding credential stuffing attacks, where 100's of accounts have attempted to log in, and part of my analysis is finding when these accounts first attempted to log in.

At the moment I've got this

 

index=keycloak
| sort time
| streamstats first(time) as first_login by username
| dedup username
| table username, first_login

 

The usernames are on display, but the 'first_login' column is empty

Labels (3)
0 Karma

Manasa_401
Communicator

Hello @jhilton90 

You can also try using stats command.

index=keycloak
| sort time
| stats first(_time) as first_login by username
| eval time=strftime(first_login,"%Y-%m-%d %H:%M:%S")

If this helps, karma would be appreciated.

Thanks,

Manasa 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jhilton90,

I don't know what you mean with "time", if you mean the events timestamp, you could try with _time:

index=keycloak
| sort time
| streamstats earliest(_time) as first_login by username
| eval first_login=strftime(first_login,"%Y-%m-%d %H:%M:%S")
| table username, first_login

Ciao.

Giuseppe

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...