Splunk Search

VPN user login from different location within one Hour

rashid47010
Communicator

Hi

I am looking for the users who login from two different countries within hour hour.

user Country signature
aqbc india authentication successful
USA authentication successful

time frame: 1 Hour

I want the query which shows me the successful authentication from two different countries against same user.

index=xaxto | iplocation src | stats count(Country) by user

Tags (1)
0 Karma

sundareshr
Legend

Try this (assuming you have IP and user extracted to respective fields)

index=xaxto "authenticateion successful" | iplocation src | table _time user country | streamstats window=1 current=f values(country) as prevcountry values(_time) as prevtime | where NOT (prevcountry=country) AND prevtime-_time>3600 | table _time user country

somesoni2
Revered Legend

I believe the last condition in where should be _time-prev_time<3600

0 Karma

rashid47010
Communicator

thanks for your kind response. can you please explain your query.
thanks

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...