Use audit events to secure Splunk Enterprise

Use Splunk to search your audit log to review and alert on administrative access:

1. Audit user access

index="_audit" action=log* action="login attempt"

2. Find the location from which users are accessing Splunk:

index="_internal" | eval timestamp=strftime(_time, "%Y-%m-%d %H:%M:%S.%Q") | table timestamp, user, clientip

3. Consider setting up a real time alert on administrative user access:

(index="_audit" action=log* action="login attempt") OR (index="_internal") user=admin

See the Alerting Manual for more information about creating alerts.

4. You can also create dashboards that collect and display your chosen searches, see Build Dashboards in Splunk Web in the Dashboards and Visualizations Manual.