https://community.splunk.com/t5/Getting-Data-In/I-need-to-get-Windows-event-details/m-p/338284#M62454 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/80254">@rahul_acc_splun</a>k2, first off you need to tweak your search filters for better performance. Move 2nd and 3rd <CODE>| search</CODE> pipes to base search. Filtering results upfront in the base search will boost your query performance, otherwise you will carry unwanted events from one command to the next and then eventually filter them out.</P> <PRE><CODE>index="wineventlog" sourcetype="wineventlog:security" (action=failure OR action=success) (EventCode=4624 OR EventCode=4625 OR EventCode=4648 OR EventCode=4768 OR EventCode=4769 OR EventCode=4771 OR EventCode=4776) </CODE></PRE> <P>After the filter command pipe the following stats command to get Success or Failure group by destinations and users.</P> <PRE><CODE>| stats count(eval(action="success")) as SuccessCount count(eval(action="failure")) as FailureCount by user dest | search FailureCount&gt;1 </CODE></PRE> <P>Only if you want list of all the destinations and just the count of Success vs Failure by user alone, you can use values(dest) and use <CODE>by user</CODE> as aggregate:</P> <PRE><CODE>| stats count(eval(action="success")) as SuccessCount count(eval(action="failure")) as FailureCount values(dest) as Destinations by user | search FailureCount&gt;1 </CODE></PRE> Tue, 29 Sep 2020 16:31:19 GMT niketn 2020-09-29T16:31:19Z https://community.splunk.com/t5/Getting-Data-In/I-need-to-get-Windows-event-details/m-p/338283#M62453 <P>index="wineventlog" sourcetype="wineventlog:security" | search (action=failure OR action=success) | search (EventCode=4624 OR EventCode=4625 OR EventCode=4648 OR EventCode=4768 OR EventCode=4769 OR EventCode=4771 OR EventCode=4776) | stats dc(action) as action values(dest) as dest count by user | where action&gt;1<BR /> This query is giving me the results for user who has successful success followed by failure but i am not able to check no of failures per destination can you please help me. <BR /> I want to have 1 coloum which would have failures number pertaining to user to respective destination. </P> Mon, 30 Oct 2017 18:00:54 GMT https://community.splunk.com/t5/Getting-Data-In/I-need-to-get-Windows-event-details/m-p/338283#M62453 rahul_acc_splun 2017-10-30T18:00:54Z https://community.splunk.com/t5/Getting-Data-In/I-need-to-get-Windows-event-details/m-p/338284#M62454 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/80254">@rahul_acc_splun</a>k2, first off you need to tweak your search filters for better performance. Move 2nd and 3rd <CODE>| search</CODE> pipes to base search. Filtering results upfront in the base search will boost your query performance, otherwise you will carry unwanted events from one command to the next and then eventually filter them out.</P> <PRE><CODE>index="wineventlog" sourcetype="wineventlog:security" (action=failure OR action=success) (EventCode=4624 OR EventCode=4625 OR EventCode=4648 OR EventCode=4768 OR EventCode=4769 OR EventCode=4771 OR EventCode=4776) </CODE></PRE> <P>After the filter command pipe the following stats command to get Success or Failure group by destinations and users.</P> <PRE><CODE>| stats count(eval(action="success")) as SuccessCount count(eval(action="failure")) as FailureCount by user dest | search FailureCount&gt;1 </CODE></PRE> <P>Only if you want list of all the destinations and just the count of Success vs Failure by user alone, you can use values(dest) and use <CODE>by user</CODE> as aggregate:</P> <PRE><CODE>| stats count(eval(action="success")) as SuccessCount count(eval(action="failure")) as FailureCount values(dest) as Destinations by user | search FailureCount&gt;1 </CODE></PRE> Tue, 29 Sep 2020 16:31:19 GMT https://community.splunk.com/t5/Getting-Data-In/I-need-to-get-Windows-event-details/m-p/338284#M62454 niketn 2020-09-29T16:31:19Z