SPL
List of Login Attempts to Splunk
4 8
Description
This will return a list of users who attempted to login to the splunk searchhead. It will list both successful attempts and failed attempts.
index=_audit tag=authentication | stats count by user, info | sort - info
Comments
1 total
index=_audit tag=authentication | dedup user | stats count by user, info timestamp | sort - info
Leave a comment
You must log in to post a comment.