SPL
Successful Login to OSX
Description
The following splunk query (with regex) will return a result of users who have successfully authenticated to an OSX machine:
*NOTE* Thanks Bob for pointing this out. The regular expression has now been fixed!
0 1
sourcetype=osx_secure | rex “authinternal\sauthenticated\suser\s(?<USER>\S+)” |eval Date=strftime(_time, "%Y/%m/%d") | stats count by USER, host, Date | sort - count
Comments
5 total
Error in 'rex' command: Encountered the following error while compiling the regex 'authinternal\sauthenticated\suser\s(?\S+)': Regex: unrecognized character after (? or (?-
Looks like they wanted to extract a USER field so change it to :-\r\n`| rex \"authinternal\sauthenticated\suser\s(?\S+)\"`
Ahh the website hides some codes. you need a to have this with the spaces removed.\r\n`(?\S+)\"`
Grrrrr Lets try this. \r\n| rex \"authinternal\sauthenticated\suser\s(?<USER>\S+)\"
Thanks Bob! It has been fixed :)
Leave a comment
You must log in to post a comment.