Splunk Search

How do I search for low counts of specific user logons per host?

rwmilligan
Explorer

I'm trying to do some least common occurance hunting in our environment, and would like to see if I can make a search that will show me hosts with low counts of user logons (say, less than 5?).

So, if my machine had me log in 30 times, and a pc tech once, even though it's legit it would show the pc tech on my machine in the search.

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@rwmilligan,

what about rare user ?

Happy Splunking!
0 Karma

imthesplunker
Path Finder

Assuming the user is xyz.

index=_internal file=login user!=- NOT streamedsearch user=xyz |stats count by host user | where count<5

0 Karma

rwmilligan
Explorer

Not by user... I would like it to show ANY user with low counts on any machine. I'll try the "rare user" command listed above, see how that works out for me.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...