Alerting

How to create a splunk alert if the user login to splunk via local credential using Splunk login type?

mala_fmr
Engager

Hi, 

We have 2 Splunk authentication systems - SAML,Splunk (default). We wanted to have an alert, if the user login to Splunk via "Splunk" authentication system.

Is there way to do that? Can we do this via Splunk query?
need help on this.

Thanks,

Mala S

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

That's in the audit logs.

index=_audit info=succeeded method=Splunk user!=internal_observability
---
If this reply helps you, Karma would be appreciated.

starcher
Influencer

with some cleanup since Splunk can't onboard their own audit logs.

index=_audit info=succeeded method=Splunk user!=internal_observability
| rename useragent as http_user_agent
| eval signature=reason." local splunk user login", src=coalesce(clientip,"unknown"), session_id=session
| iplocation prefix=src_ src
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...