×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
jstump1972
New Member
Member since: ‎08-29-2018
‎06-05-2020
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎08-29-2018
Activity Feed
View All

How do you search for users logged in to multiple ...

by in Getting Data In
‎10-31-2018 06:17 AM
‎10-31-2018 06:17 AM
Fellow Splunkers, I am working on a query to monitor our Active Directory logins, and I want to watch for users logging into multiple machines within 15 minutes as an example to watch for things like shared credentials amongst staff or the account that has been compromised. The current search I have is below, but it isn't quite right. index=wineventlog earliest=-4h | timechart span=15m dc(Client_Address) AS client_address_count by user ... View more

Can you help me create a search that returns Audit...

by in Splunk Enterprise Security
‎08-29-2018 09:25 AM
‎08-29-2018 09:25 AM
I need to perform a security audit on a particular user. I need to enter in specific username = example mydomain\jimbob I need to show logon \ logoff results I need to show times of logon \ logoff I need to show pc name - I assume this is source_network_address? I need to show IP address of pc I need to be specific on date range as well such as 08-13-2018 to 08-17-2018 ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM