This simple Splunk query will show us unique Splunk user logged into Splunk per day, as well as total count of log-ons.
|
1 |
index=_audit info=succeeded | timechart span=1d dc(user) as unique_users count(user) as logons_all_users |
List All Splunk Users & Associated Roles
The following Splunk query will show a table of all users and their roles:
|
1 |
| rest /services/authentication/users | stats values(roles) as Roles by user |
*Admin Notes* I’ve found the following query to work better in my environment:
|
1 |
| rest /services/authentication/users | stats values(roles) as Roles by title |
Splunk Admin Account Activity – Role Modifications
This Splunk query shows when the admin account performed Create or Modify Roles actions:
|
1 |
index="_audit" action=edit_roles operation=* | table _time user operation object* |
Splunk Admin Account Activity – Account Modifications
This Splunk query shows when the admin account performed Account Modification / Deletion / Creation actions:
|
1 |
index=_audit user=admin action=edit_user operation=* | table _time user operation object* |
Index Modifications
This Splunk query should show which users attempted to modify an index and if that action was successful:
|
1 |
index=_audit user=* action=indexes_edit | stats count by index info user action |
Splunk Server Restart Duration
As titled, the following Splunk search query will show the restart duration (using the transaction command) of the Splunk service itself.
|
1 |
index=_audit (action="splunkShuttingDown" OR action="splunkStarting") | eval Date=strftime(_time, "%Y/%m/%d") | transaction splunk_server startswith=action="splunkShuttingDown" endswith=action="splunkStarting" | eval duration=round(duration/60, 2) |table Date splunk_server duration| rename duration as "Splunk Restart Duration" splunk_server as "Splunk Server" |
Splunk Query Count by users
|
1 |
index=_audit search=* NOT (search_id='scheduler* OR search_id='Summary*) user=admin | timechart span=1d count by user usenull=f |
Failed Attempts to Logon to Splunk Web
The following Splunk Search Query will return all users who have failed to logon to the Splunk Web console. This query will also include an average (from eventstats).
|
1 |
index=_audit action="login attempt" info=failed | timechart count(user) as Failed_Attempts| eventstats avg(Failed_Attempts) as Average |
