I'm new to splunk and I have 2 machines with forwarder pushing to my splunk computer. I want to know is it possible to show the number of logins and time length they are logged in. I want to put this is a graph if possible. I'm trying to show my boss that people are using these 2 computers.
What kind of information are you putting into Splunk? is it Windows or Linux or...?
Are both logins and logouts recorded? Can you give an example of what each event looks like?
This sort of search is pretty easy to do, but the community needs a little more information in order to help you...
using a windows environment. Logins are recorded can see them. However my boss wants to know how many people use these computers in a 7 day windows and how long they are used for.
So could you identify logins/logouts using Windows Event Codes? (I am not a Windows person.) What event codes do you use for valid logins and logouts?