https://community.splunk.com/t5/Splunk-Dev/AD-monitoring/m-p/324729#M4609 <P>Hi SoknySplunk,<BR /> if you're already receiving logs from AD, try something like this</P> <PRE><CODE>index=wineventlog sourcetype=WinEventLog:Security (EventCode=4720 OR EventCode=4624) | table _time host RecordNumber user_id signature status admin_id src_ip logonby logon_time Create_time Logon_ID </CODE></PRE> <P>verify if the field names are correct related to your logs.</P> <P>Bye.<BR /> Giuseppe</P> Tue, 25 Jul 2017 07:23:48 GMT gcusello 2017-07-25T07:23:48Z https://community.splunk.com/t5/Splunk-Dev/AD-monitoring/m-p/324728#M4608 <P>I want to collect log from user AD. I have used eventcode 4720 and eventcode 4624. i wonder how to combine these two events together and get table like this: host, RecordNumber, user_id, signature, status, admin_id, src_ip, logonby, logon_time, Create_time, Logon_ID</P> Tue, 29 Sep 2020 15:01:04 GMT https://community.splunk.com/t5/Splunk-Dev/AD-monitoring/m-p/324728#M4608 SoknySplunk 2020-09-29T15:01:04Z https://community.splunk.com/t5/Splunk-Dev/AD-monitoring/m-p/324729#M4609 <P>Hi SoknySplunk,<BR /> if you're already receiving logs from AD, try something like this</P> <PRE><CODE>index=wineventlog sourcetype=WinEventLog:Security (EventCode=4720 OR EventCode=4624) | table _time host RecordNumber user_id signature status admin_id src_ip logonby logon_time Create_time Logon_ID </CODE></PRE> <P>verify if the field names are correct related to your logs.</P> <P>Bye.<BR /> Giuseppe</P> Tue, 25 Jul 2017 07:23:48 GMT https://community.splunk.com/t5/Splunk-Dev/AD-monitoring/m-p/324729#M4609 gcusello 2017-07-25T07:23:48Z