About Aufex

Aufex · ‎01-16-2025

Hi, after your basic search you can create a table. Then you can use replace like | replace blub with 1blub ... Then you create a chart and do a rename after.

Aufex · ‎10-20-2023

Hello everyone, we use LDAPS in Splunk to allow our employees to log in to the system (Search Heads). Is there a way for users to change their passwords when needed or after they have expired? Some users only access Splunk and do not have any other means to update their passwords.

Aufex · ‎11-30-2017

Hello, I want to identify the login and logouts for each user on a server. I use the event_id 4624 (logon) and 4634(logoff). the problem is that Windows generates multiple events for only one login/logoff. It seems that they share the same login_id. so I try something like: host="server a" user="allice" (EventCode=4624 OR EventCode=4624 ) now I need something like: | where login_id= login_id So that I get only 2 events for one login/logoff , but for all users and over time 🙂 Thanks for reading.

Aufex · ‎11-28-2017

perfect, thank you!!

Aufex · ‎11-28-2017

the chart only show you the users and the number of events of each user. the table should show you user,NAS_IP, count(user) there can only be one NAS_IP for each user

Aufex · ‎11-28-2017

Hello, my querry 'sourcetype="xxx" radius authentication failed | chart count by user | sort - count' gives me a nice little chart und a table under it. My problem is that i can not add an additional collum "NAS_IP_Adress". can you give me any tips? thanks

Aufex · ‎08-01-2017

Hi, i audit my firewall with action=blocked earliest=-1d@d latest=@d | stats count by host src_zone dest_zone | sort - count that work fine and gives me a good overview. Now i try to compare each resulting count with the counts given 8 days ago. when i try to | append [] splunk gives an error. can you help me? thanks

Aufex · ‎08-01-2017

thank you. yes ports change a lot. i think its much smarter to display the zones 🙂

Aufex · ‎08-01-2017

Hi, i try to identify how often a user account was loged on. the problem is that the DC generates multible 4624 in very short time (different processes?). is there any best practice soltion to get a correct number of logon events? there are some topic whit that question but i cant find any useable solution. i tryes with | debuc Logon_GUID but that dont work 😞 sourcetype="WinEventLog:Security" EventCode=4624| eval Account_Name=if(Account_Name="-", (mvindex(Account_Name,1)), Account_Name)| eval Account_Domain=if(Account_Domain="-", (mvindex(Account_Domain,1)), Account_Domain)| dedup Logon_GUID | chart count by Account_Name | sort - count

Aufex · ‎07-31-2017

Hi there, i try to buildup a firewall report: "sourcetype="firewall" action=blocked | table host src dest src_port dest_port" this gives me endless rows, and many of them are dublicated. i try to delete all the dublicates and count them so that i have something like HOST | SRC | DEST | SRC_PORT | DEST_PORT | COUNT that would give a nice overview.

Posts	11
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎07-31-2017

Online Status	Offline
Date Last Visited	‎01-16-2025 08:45 AM

ldap/s update user password

How can I identify login and logoff times for user...

adding a collum in a "...| chart count by x"

compare | stats count by x y z over different days

best practice multiple eventID 4624 for one logon

Count matching values on seperated fields

Re: Customize Order of Column Chart by sort_order ...