Splunk Search

Help with searching command

drobles96
Engager

Hi Everyone! I'm having a stuff time trying to figure out a search command for this lab assignment. So I inputted in the search bar, (source=/var/log/auth.log session | top user) and I got the users and a count but not sure if thats the session count. I've tried other ones but don't seem to get the results I need. I need a search command that'll show the opened and closed sessions based on each user so I could create a pie chart showing that data. I'm currently a student in cybersecurity and I'm new to Splunk. Would appreciate the help. Thank you! 🙂

 

Screen Shot 2020-11-24 at 9.38.02 PM.png

 

Labels (6)
0 Karma
1 Solution

thambisetty
Super Champion

@drobles96 

The keywords you can use from auth.log for session open  is "session opened" and session close is "session closed"

open sessions based on user:

Option: 1 - The below query will give all users and their open sessions count and count will be sorted in descending order. you will see top count first

index=<foo>  source=<sourceyoumentionedabove> "session opened" | stats count by user | sort - count

Option:2 -  The below query will give you same but top by default limit number of rows to 10. To get unlimited users then you should specify top 0 user ( 0 is no limit). top 20 user ( top 20 users).

index=<foo>  source=<sourceyoumentionedabove> "session opened" | top 0 user

You can do same for session closed by just replacing "session opened" with "session closed"  in above queries.

————————————
If this helps, give a like below.

View solution in original post

thambisetty
Super Champion

@drobles96 

The keywords you can use from auth.log for session open  is "session opened" and session close is "session closed"

open sessions based on user:

Option: 1 - The below query will give all users and their open sessions count and count will be sorted in descending order. you will see top count first

index=<foo>  source=<sourceyoumentionedabove> "session opened" | stats count by user | sort - count

Option:2 -  The below query will give you same but top by default limit number of rows to 10. To get unlimited users then you should specify top 0 user ( 0 is no limit). top 20 user ( top 20 users).

index=<foo>  source=<sourceyoumentionedabove> "session opened" | top 0 user

You can do same for session closed by just replacing "session opened" with "session closed"  in above queries.

————————————
If this helps, give a like below.

drobles96
Engager

Thank you very much!!

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...