topic Re: How Do I assign src_ip to all event codes those are having same Logon_ID? in Getting Data In

How Do I assign src_ip to all event codes those are having same Logon_ID?

90509 — Wed, 30 Sep 2020 03:54:07 GMT

I would like to assign src_ip to all events who is having same logon_id. but the src_ip coming only to EventCode=4624.
could you please let me know

Re: How Do I assign src_ip to all event codes those are having same Logon_ID?

to4kawa — Wed, 30 Sep 2020 03:47:57 GMT

EventCode=4624 has both src_ip and logon_id?

Re: How Do I assign src_ip to all event codes those are having same Logon_ID?

90509 — Wed, 30 Sep 2020 03:54:12 GMT

yes but some events having only Logon_Id so for those need to assign src_ip as well

Re: How Do I assign src_ip to all event codes those are having same Logon_ID?

90509 — Wed, 30 Sep 2020 03:54:16 GMT

Do I need to perform any join operations

Re: How Do I assign src_ip to all event codes those are having same Logon_ID?

to4kawa — Thu, 23 Jan 2020 11:57:36 GMT

Updated:

index=wineventlog EventCode=* Logon_ID!="0x0"
| eventstats values(src_ip) as src_ip by Logon_ID
| stats values(EventCode) as EventCode by Logon_ID src_ip

Hi, @90509
How about this?

Re: How Do I assign src_ip to all event codes those are having same Logon_ID?

90509 — Wed, 30 Sep 2020 03:54:25 GMT

I appreciate your help but I need want the table like

suppose if take one logon_ID for that Logon_ID having number of event codes like EventCode=4624 or 4625 0r 4672 or 4648, so in this scenario all the events codes having same Logon_Id but for EventCode=4624 only having src_ip. so need to fetch the results along with src_ip assigning the Events or EventCodes having same Logon_ID.

Re: How Do I assign src_ip to all event codes those are having same Logon_ID?

90509 — Wed, 30 Sep 2020 03:54:28 GMT

from according your query if there is no src_ip for any eventcodes which is not populating but I want all event codes who is having same Logon_ID will be assigned with same src_ip.

Re: How Do I assign src_ip to all event codes those are having same Logon_ID?

to4kawa — Wed, 30 Sep 2020 03:48:00 GMT

How Do I assign src_ip to all event codes those are having same Logon_ID?

I think it has nothing to do with the table display.
I updated the answer, but I'm not sure.