Splunk Search

how to get the number of logins per user for the past 30 days?

kiran_mh
Explorer

We want to know how to get the number of logins per user for the past 30 days? and also, if there is a metric we can see how long users are logged into the system .

Tags (1)
0 Karma
1 Solution

teunlaan
Contributor

number of logins : index=_audit info=succeeded action="login attempt" | stats count by user

How many hours someone someone is accessing is very hard to get (in my opinion)
You could calculate the time between login and logout times. BUT most users don't press the logout button, so you don't have the data.

So you should track when users fires searches.

View solution in original post

0 Karma

teunlaan
Contributor

number of logins : index=_audit info=succeeded action="login attempt" | stats count by user

How many hours someone someone is accessing is very hard to get (in my opinion)
You could calculate the time between login and logout times. BUT most users don't press the logout button, so you don't have the data.

So you should track when users fires searches.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Logins to what? Which system?

---
If this reply helps you, an upvote would be appreciated.
0 Karma

kiran_mh
Explorer

how to get the number of logins per user for the past 30 days
in splunk
also, if there is a metric we can see how long users are logged into the splunk

We also need to know how much hours a user is accessing splunk per day

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!