List of Login Attempts to Splunk audittrail CattyWampus 1 Comment Vote Up +4 Vote Down -8You already voted! This will return a list of users who attempted to login to the splunk searchhead. It will list both successful attempts and failed attempts. index=_audit tag=authentication | stats count by user, info | sort - info Share This: Tagged: audittrailInternal LoginInternal Logonsplunk on splunk
chris October 14, 2022 at 4:29 pm index=_audit tag=authentication | dedup user | stats count by user, info timestamp | sort – info Reply
index=_audit tag=authentication | dedup user | stats count by user, info timestamp | sort – info