Splunk Search

Would someone know how to find out who is logged into a specific computer?

SplunkMiester
New Member

Would someone know how to find out who is logged into a specific computer. Thanks in advance!

0 Karma

SplunkMiester
New Member

Actually, I'm looking to do two things:

Finding computer based on username

Finding users logged into a computer

0 Karma

richgalloway
SplunkTrust
SplunkTrust

We don't have much to work with.  The exact steps to follow depend on the OS the computer is using as well as what data you have in Splunk.  For instance, if logins are not indexed then you won't be able to find out who is logged in to any computer.

A sample query for logins to a specific computer is

index=windows EventCode=4768 ComputerName=somecomputer
| table _time Account_Name
---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...