Security

Login connections made to splunk

akarivaratharaj
Communicator

I would like to fetch No. of logins on Splunk (how frequently my splunk is being accessed). It is basically, how many connections are made to splunk for indexing/searches.

I am unaware where this information will be available on Splunk. Could anyone please help me to know , how and where can I get this information.

0 Karma

mayurr98
Super Champion
0 Karma

akarivaratharaj
Communicator

Hi @mayurr98,

Thankyou for your quick response. I have referred the above link which you shared.

In that post they have mentioned the below query to find the number of logins made to Splunk.
"index=_audit info=succeeded action="login attempt" | stats count by user"

This query is giving only the count of logins which are made by splunk users. It is good enough. But in addition to this, I need the login attempts made by other servers/databases also. For example, I have setup a forwarder in Host X. All the required log details from the host X is forwarded to my splunk instance and index over there. So while indexing also, my splunk is been accessed by the host/forwarder. I would like to have that information also.

How about the logs available in "sourcetype=WinEventLog:Security"? I have referred some posts, where people were discussing about the EventCode 4625 or 4624 (login success/failure).

Any idea where can I get those logs too?

0 Karma

mayurr98
Super Champion

Hi well the link i have shared will give you info about only splunk as splunk by default stores internal logs like audit,introspection,etc. In order to index the remote host logs you would need to monitor those files.
In order to monitor windows event logs data refer this:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Data/MonitorWindowseventlogdata

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...