Hi,
I want to make a search query on Linux which gives me a list of top 5 users who have accessed the linux machine the most number of times. I have /var/log/secure logs monitored. Please help.
An example log is helpful here, but you simply splunk the logs, create a field called user if it doesn't exist already, and then run the search. For example, if I want to see this result for the past 30 days:
sourcetype=mysecurelog earliest=-30d latest=now | top user limit=5