Splunk Search

How do I search for users logging into our Splunk server remotely?

codymoore
New Member

We had a user log in remotely either with ESXI, with a VM, with Remote Desktop or with the command prompt using SSH. Our Splunk server is on a domain and we are trying to determine who logged in and made the changes. I have searched the forum and cannot find a definite answer in the community. I'm fairly new to Splunk with writing queries and all so appreciate any help and/or advice anyone can give. Thanks,

0 Karma

Lazarix
Communicator

Assuming it's linux, run this command on the host:

last

you can also search

/var/log/secure

for "sshd"

Additionally, the Splunk App for Unix extracts data from /var/log/secure and other such system level logs so you can consume that data in Splunk.

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

Hi @codymoore! Thanks for posting on Splunk Answers!

Could you provide more info about this problem? Have you tried to craft any searches yourself? If so, if you post them, our users might be more inclined to help you out! Not only will that give you a greater chance of having your question answered, it will also help us categorize the problem so others with similar problems can learn from it.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...