Splunk Search for Most active linux users Copy
sourcetype=linux_secure NOT "invalid user" | rex "\suser\s(?<User>[^\s]+)\s" | top User showperc=f
0 comments
Splunk Search for Count of Unique linux users Copy
sourcetype=linux_secure NOT "invalid user" | rex "\suser\s(?<User>[^\s]+)\s" | statsdc(User) as "Unique Users"
0 comments
Splunk Search for List of linux user accounts Copy
sourcetype=linux_secure NOT "invalid user"| rex "\suser\s(?<User>[^\s]+)\s" | stats count by User
0 comments