Splunk Search

Search that shows first and last event time + total count of events per user

snix
Communicator

I have a list of top 10 users that failed to login to a site and I want to take the events related to those top ten users and get a read out of:
Time of first event
Time of last event
Total number of events

This would be relating to each user in that top ten list. Here is an example of what it would look like on paper:
---user_email--------------Start--------------------------------Stop----------------------------------Total
1. bob@bob.com---------02/28/17 - 01:16:19:PM-------09/22/17 - 10:36:51:AM---------35
2. smith@smith.com-----04/1/17 - 05:32:15:PM --------06/26/17 - 11:22:06:PM---------7

Here is what I have so far, really I am just missing how I can get the total number of events per user column:
index="test" Event_ID="123456" [search index="test"Event_ID="123456" | top limit=10 user_email | table user_email]
| stats earliest(_time) as start, latest(_time) as stop by user_email
| eval start=strftime(start, "%m/%d/%y - %I:%M:%S:%p")
| eval stop=strftime(stop, "%m/%d/%y - %I:%M:%S:%p")

0 Karma
1 Solution

sbbadri
Motivator

@snix

try this,

index=test Event_ID="123456" [search index="test"Event_ID="123456" | top limit=10 user_email | table user_email] | stats count as Total , earliest(_time) as start, latest(_time) as stop by user_email | eval start=strftime(start, "%m/%d/%y - %I:%M:%S:%p") | eval stop=strftime(stop, "%m/%d/%y - %I:%M:%S:%p") | table user_email start stop Total

View solution in original post

0 Karma

snix
Communicator

@sbbadri

That did the trick!!! Thank you!!!

0 Karma

sbbadri
Motivator

@snix

try this,

index=test Event_ID="123456" [search index="test"Event_ID="123456" | top limit=10 user_email | table user_email] | stats count as Total , earliest(_time) as start, latest(_time) as stop by user_email | eval start=strftime(start, "%m/%d/%y - %I:%M:%S:%p") | eval stop=strftime(stop, "%m/%d/%y - %I:%M:%S:%p") | table user_email start stop Total

0 Karma
Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...