All Apps and Add-ons

Writing a Splunk Query - Unique Count of Initial Access Key Usage from Cloudtrail

tosilesi19
New Member

I have a use case to write a splunk query to display in a line or area chart the unique and initial AWS access key usage by IAM users in our org trending for the past year. Management want to be able to visually show increased cloud adoption numbers over time. Any ideas on how to display this? I feel like I'm almost there with stats but not quite.

index=blah sourcetype=blah user_type=SAMLuser | stats earliest(eventTime) by userIdentity.userName

This almost gets me there, but it won't depict the stats in a pretty line chart.

Thanks!

Labels (1)
0 Karma

to4kawa
Ultra Champion

If eventTime is epoch time, how about this?

index=blah sourcetype=blah user_type=SAMLuser 
| stats earliest(eventTime) as _time by userIdentity.userName
| timechart count by userIdentity.userName
0 Karma

tosilesi19
New Member

this gets me closer! but the userIdentity.userName values are all just flat on the x-axis. I need them to display clearly based on the date they were first used.

0 Karma

to4kawa
Ultra Champion

what's y-axis?
a line or area chart's y-axis is number,you know.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...