https://community.splunk.com/t5/Security/Search-for-Windows-EventCode-not-caused-by-a-Logon-attempt/m-p/56856#M13931 <P>You might be able to filter your result set by looking at the "Process Name:" field. Or post a few of your offending events to get a better look as to what you need to filter out .</P> Mon, 10 Jun 2013 16:48:03 GMT JSapienza 2013-06-10T16:48:03Z https://community.splunk.com/t5/Security/Search-for-Windows-EventCode-not-caused-by-a-Logon-attempt/m-p/56855#M13930 <P>We have to search for EventCode 4656 for Windows 7 and 2008 Server.</P> <P>A lot of the 4656 are caused by logons (4624) and is there a way to search for 4656 and only show ones that are not caused by a logon.</P> <P>Lets say, dont show any 4656 within 30 seconds of a 4624.</P> <P>Thanks</P> Thu, 06 Jun 2013 14:08:17 GMT https://community.splunk.com/t5/Security/Search-for-Windows-EventCode-not-caused-by-a-Logon-attempt/m-p/56855#M13930 mitchmd1 2013-06-06T14:08:17Z https://community.splunk.com/t5/Security/Search-for-Windows-EventCode-not-caused-by-a-Logon-attempt/m-p/56856#M13931 <P>You might be able to filter your result set by looking at the "Process Name:" field. Or post a few of your offending events to get a better look as to what you need to filter out .</P> Mon, 10 Jun 2013 16:48:03 GMT https://community.splunk.com/t5/Security/Search-for-Windows-EventCode-not-caused-by-a-Logon-attempt/m-p/56856#M13931 JSapienza 2013-06-10T16:48:03Z