Activity Feed
- Got Karma for Finding the 1st logon and logoff event times for a single user from March 2017 to present.. 06-05-2020 12:49 AM
- Karma Re: How to get to grips with SPL. for martin_mueller. 06-05-2020 12:48 AM
- Karma Re: How to get to grips with SPL. for sheamus69. 06-05-2020 12:48 AM
- Karma Re: How to get to grips with SPL. for GregZillgitt. 06-05-2020 12:48 AM
- Posted Finding the 1st logon and logoff event times for a single user from March 2017 to present. on Getting Data In. 08-29-2017 02:04 AM
- Tagged Finding the 1st logon and logoff event times for a single user from March 2017 to present. on Getting Data In. 08-29-2017 02:04 AM
- Tagged Finding the 1st logon and logoff event times for a single user from March 2017 to present. on Getting Data In. 08-29-2017 02:04 AM
- Tagged Finding the 1st logon and logoff event times for a single user from March 2017 to present. on Getting Data In. 08-29-2017 02:04 AM
- Tagged Finding the 1st logon and logoff event times for a single user from March 2017 to present. on Getting Data In. 08-29-2017 02:04 AM
- Tagged Finding the 1st logon and logoff event times for a single user from March 2017 to present. on Getting Data In. 08-29-2017 02:04 AM
- Posted How to get to grips with SPL. on Splunk Search. 01-27-2017 01:43 AM
- Tagged How to get to grips with SPL. on Splunk Search. 01-27-2017 01:43 AM
- Tagged How to get to grips with SPL. on Splunk Search. 01-27-2017 01:43 AM
- Tagged How to get to grips with SPL. on Splunk Search. 01-27-2017 01:43 AM
- Tagged How to get to grips with SPL. on Splunk Search. 01-27-2017 01:43 AM
- Tagged How to get to grips with SPL. on Splunk Search. 01-27-2017 01:43 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 | |||
| 0 |
08-29-2017
02:04 AM
1 Karma
Hello,
I've been asked to find the 1st login time of a user and the time they logged out over a specific date range. (march 1st 2017 - present)
The environment is a Window's terminal services environment (Windows Server 2008 R2) and is being indexed into Splunk. The index is index= index="wineventlog"
I'd like to see something like this; (if possible)
username: user
date: 01/MAR/2017
Logon: 07:30:00
Logoff: 15:30:00
For each day from march 1st to present, I can find the events but can't order them or filter them to show just the 1st login and last logoff of that day.
Appreciate the help,
Jake
... View more
01-27-2017
01:43 AM
Hi guys,
I'm new to splunk, and we have recently implemented splunk enterprise in our environment. We are primarily looking at using "splunk app for windows infrastructure" for DPA requirements. We currently have one server doing everything (windows server 2012R2 12GB RAM 12CPU) running in a visualised environment, VMware.
I have configured our DC's to be universal forwarders and have set up the data inputs so I can search and query the data along with creating reports and alerts. Can you help me get to grips with SPL? The only other language I know is PowerShell, is there any documentation/video's or cheat sheets on SPL?
I have watched the Pluralsight courses on splunk, however these are more of an introduction to splunk and not as in-depth as I need, although they are useful.
Thanks in advance,
Jake
... View more
