Posted this on Splunk Answers. Trying to come up with a way to log when multiple users are logged into the same machine simultaneously.

The sourcetypes I have are: Cisco ISE, Windows Security, and Active Directory.

The catch is we're primarily a MAC shop. My hope was to leverage Cisco ISE - a really fancy Radius-Like network authentication server - to capture Username and IP Addresses. Though things haven't gone quite as I'd hoped.

sourcetype="cisco:ise:syslog" (Framed_IP_Address!="...\\" AND Framed_IP_Address!="\\") (User_Name!="*-*-*-*-*-*" AND User_Name!="" AND User_Name!="anonymous")
| stats  values(User_Name) as Users, dc(User_Name) AS user_count by Framed_IP_Address
| sort  - user_count, Users
| table  Framed_IP_Address, Users, user_count

I was hoping someone could review the above line, and provide advice on how to better search for multiple users logged into the same IP Address.