cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question
mikeyemane
New Member
Member since: ‎03-21-2018
‎09-14-2021
Community Statistics
Posts 4
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎03-21-2018
Activity Feed
View All

How do I track a user's login session from VPN to ...

by in Security
‎08-29-2018 08:32 AM
‎08-29-2018 08:32 AM
I would like to to be able to track a users login session from VPN and then login to a Windows server(s). User login scenario: VPN login --> Windows Server Login --> Windows Server Login VPN Search --> userid=user.id index=x "Login succeeded" | rex "\]\sGDI\\\(?<userid>[^\(]+)" Windows Search --> user=user.id index=wineventlog sourcetype="WinEventLog:Security" Account_Name!="*$" AND Account_Name!=SYSTEM AND EventCode=4624 AND user!="ANONYMOUS LOGON" I would like to create a table that shows their login time at the VPN, login time and process(s) started on the Windows servers. I can do this separately but how do you do combine the search? Thanks. ... View more

Re: Splunk - Join two queries from same index and ...

by in Splunk Search
‎03-21-2018 08:48 PM
‎03-21-2018 08:48 PM
Thank you. This gave me what I was looking for. Response from kyaparla was also good. Thank you both. ... View more

Re: Splunk - Join two queries from same index and ...

by in Splunk Search
‎03-21-2018 06:31 PM
‎03-21-2018 06:31 PM
Thanks for help Rich. First event shows userid, time session started, and srcip. Second event shows the same, except time session ended and session duration (4911 seconds). I want to generate a table of userid, srcip, time session started, time session ended, and duration. Here are the two searches that kind of get me what I'm looking for: index=juniper-mag host=abc.defg.net _raw="Login succeeded" | eval fields=split(_raw, " ") | eval user=mvindex(fields,14) | eval srcip=mvindex(fields, 13) | table _time user srcip index=juniper-mag host=abc.defg.net _raw="Closed connection" | eval fields=split(_raw, " ") | eval duration=mvindex(fields,23) | table _time user duration ... View more

Splunk - Join two queries from same index and even...

by in Splunk Search
‎03-21-2018 03:39 PM
‎03-21-2018 03:39 PM
I have the following two events from the same index (VPN). I've been unable to try and join two searches to get a table of users logged in to VPN, srcip, and sessions (if logged out 4911 field). I'm able to pull out this infor if I search individually but unable to combine. Thanks for the help. 259 <166>1 2018-03-21T10:13:45-04:00 abc.defg.net PulseSecure: - - - 2018-03-21 10:13:45 - ive - [12.34.56.78] DHI\john(VPN)[VPN] - Login succeeded for FHI\john/VPN (session:be1c9211) from 12.34.56.78 with Open AnyConnect VPN Agent v7.08 276 <166>1 2018-03-21T11:35:39-04:00 abc.defg.net PulseSecure: - - - 2018-03-21 11:35:39 - ive - [12.34.56.78] DHI\john(VPN)[VPN] - Closed connection to TUN-VPN port 443 after 4911 seconds, with 2171883 bytes read (in 6 chunks) and 90236 bytes written (in 8 chunks) ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎09-14-2021 04:14 PM