Splunk Search

VPN user login from different location within one Hour

rashid47010
Communicator

Hi

I am looking for the users who login from two different countries within hour hour.

user Country signature
aqbc india authentication successful
USA authentication successful

time frame: 1 Hour

I want the query which shows me the successful authentication from two different countries against same user.

index=xaxto | iplocation src | stats count(Country) by user

Tags (1)
0 Karma

sundareshr
Legend

Try this (assuming you have IP and user extracted to respective fields)

index=xaxto "authenticateion successful" | iplocation src | table _time user country | streamstats window=1 current=f values(country) as prevcountry values(_time) as prevtime | where NOT (prevcountry=country) AND prevtime-_time>3600 | table _time user country

somesoni2
Revered Legend

I believe the last condition in where should be _time-prev_time<3600

0 Karma

rashid47010
Communicator

thanks for your kind response. can you please explain your query.
thanks

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...