Firstly, my data is formatted like this:
Dec 15 13:58:12 gthou-nsacs01p CisACS_01_PassedAuth ne8yfimc 1 0 Message-Type=Authen OK,User-Name=Adorton,NAS-IP-Address=10.71.11.7,Caller-ID=174.253.112.223,NAS-Port=124190720,Group-Name=VPN Neudesic,Filter Information=No Filters activated.,AAA Server=gthou-nsacs01p,Network Device Group=Wireless and VPN,Access Device=phe-ardmore-int-sa00-rad,
I've created an eventtype which keys on "Message-Type=Authen OK" called acs-authentication-success. The query I'm working off of looks like this:
eventtype=acs-authentication-success | uniq User_Name | sort User_Name, -_date | fields User_Name, _time
However, rather than displaying the latest time that every User_Name was seen in the syslog data, it returns EVERY individual instance. I'm new to splunk reporting and would appreciate any assistance. Thanks in advance!
First, do not use uniq
. I don't even know why it even exists. Try:
eventtype=acs-authentication-success | dedup User_Name | fields User_Name, _time
or
eventtype=acs-authentication-success | stats latest(_time) by User_Name
First, do not use uniq
. I don't even know why it even exists. Try:
eventtype=acs-authentication-success | dedup User_Name | fields User_Name, _time
or
eventtype=acs-authentication-success | stats latest(_time) by User_Name
Awesome, that definitely got my results as I expected them. Thank you so much! Can you point me to a document that will help me to export the dataset to a CSV with the User_name and the _time?