topic Re: Why is my timestamp not working in Windows event logs? in Getting Data In

Why is my timestamp not working in Windows event logs?

HCadmins — Tue, 07 Mar 2017 17:09:28 GMT

Here is my search

index=wineventlog Account_Domain=* ("EventCode=4625" OR "EventCode=4740") | stats count count(eval(EventCode=4740)) as LockedCount by user Account_Domain | search count>3 | eval Locked=if(LockedCount>1, "Yes", "No") | table _time user count Account_Domain Locked | rename user as "User" count as "Failed Authentication Attempts" Account_Domain as "Domain"

When I look at the log raw data, there is clearly a time stamp.

Re: Why is my timestamp not working in Windows event logs?

woodcock — Tue, 07 Mar 2017 17:16:52 GMT

What is your inputs.conf for this?

Are your indexers using NTP? Do you have the TZ settings correct for this input?

Re: Why is my timestamp not working in Windows event logs?

HCadmins — Tue, 07 Mar 2017 17:24:04 GMT

My time zone settings are correct, as other inputs are correctly recording time.

If I remove most of the search string like this

index=wineventlog Account_Domain=* | table _time

The time shows up perfectly.

Re: Why is my timestamp not working in Windows event logs?

HCadmins — Tue, 07 Mar 2017 17:29:24 GMT

When I add in the | stats part is when it seems to break

index=wineventlog Account_Domain=* ("EventCode=4625" OR "EventCode=4740") | stats count count(eval(EventCode=4740)) as LockedCount by user Account_Domain | table _time

Shows no results

Re: Why is my timestamp not working in Windows event logs?

richgalloway — Tue, 07 Mar 2017 17:33:51 GMT

The stats command is only passing the count, LockedCount, user, and Account_Domain fields to downstream commands so there is no _time to display. Try using either eventstats or streamstats.

Re: Why is my timestamp not working in Windows event logs?

HCadmins — Tue, 07 Mar 2017 17:36:23 GMT

Okay, that made it work. Why is count in there twice?

streamstats count count(eval...)

(I used this code snipped from another Splunk answer)

Re: Why is my timestamp not working in Windows event logs?

richgalloway — Tue, 07 Mar 2017 21:11:36 GMT

The first counts all events and the second counts only those events where EventCode=4740.