Splunk Search

Return First user and _time from ACS syslog

buldamoosh
New Member

Firstly, my data is formatted like this:

Dec 15 13:58:12 gthou-nsacs01p CisACS_01_PassedAuth ne8yfimc 1 0 Message-Type=Authen OK,User-Name=Adorton,NAS-IP-Address=10.71.11.7,Caller-ID=174.253.112.223,NAS-Port=124190720,Group-Name=VPN Neudesic,Filter Information=No Filters activated.,AAA Server=gthou-nsacs01p,Network Device Group=Wireless and VPN,Access Device=phe-ardmore-int-sa00-rad,

I've created an eventtype which keys on "Message-Type=Authen OK" called acs-authentication-success. The query I'm working off of looks like this:

eventtype=acs-authentication-success | uniq User_Name | sort User_Name, -_date | fields User_Name, _time

However, rather than displaying the latest time that every User_Name was seen in the syslog data, it returns EVERY individual instance. I'm new to splunk reporting and would appreciate any assistance. Thanks in advance!

Tags (1)
0 Karma
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

First, do not use uniq. I don't even know why it even exists. Try:

eventtype=acs-authentication-success | dedup User_Name | fields User_Name, _time

or

eventtype=acs-authentication-success | stats latest(_time) by User_Name

View solution in original post

0 Karma

gkanapathy
Splunk Employee
Splunk Employee

First, do not use uniq. I don't even know why it even exists. Try:

eventtype=acs-authentication-success | dedup User_Name | fields User_Name, _time

or

eventtype=acs-authentication-success | stats latest(_time) by User_Name
0 Karma

buldamoosh
New Member

Awesome, that definitely got my results as I expected them. Thank you so much! Can you point me to a document that will help me to export the dataset to a CSV with the User_name and the _time?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...