<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Transaction-like  login events in Knowledge Management</title>
    <link>https://community.splunk.com/t5/Knowledge-Management/Transaction-like-login-events/m-p/544225#M4956</link>
    <description>&lt;P&gt;Hi,&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I have applications that log login events as multiple events.&lt;/P&gt;&lt;P&gt;Example:&lt;/P&gt;&lt;P&gt;&lt;FONT face="courier new,courier"&gt;[07B0:007E-19E8] 2021.03.17 11:59:01 Opened session for User Name/HEXP/HU (Release 8.0.2FP6)&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT face="courier new,courier"&gt;[07B0:007E-19E8] 2021.03.17 11:59:01 ATTEMPT TO ACCESS SERVER by User Name/HEXP/HU was denied&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT face="courier new,courier"&gt;[07B0:007E-1408] 2021.03.17 11:59:01 Closed session for User Name/HEXP/HU Databases accessed: 0 Documents read: 0 Documents written: 0&lt;/FONT&gt;&lt;/P&gt;&lt;P&gt;This is an unsuccessful login event.&lt;/P&gt;&lt;P&gt;when the login is successful, only the first event is logged. I can connect these events with transaction, which is ok for some reporting purposes. But if I use transaction then I can't tag these events and I can't make the logs CIM compliant.&lt;/P&gt;&lt;P&gt;Is there a way to handle these kind of situations?&amp;nbsp; Or it is not possible to tag these kind of events correctly?&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Thanks,&lt;/P&gt;&lt;P&gt;László&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Wed, 17 Mar 2021 15:55:53 GMT</pubDate>
    <dc:creator>nembela</dc:creator>
    <dc:date>2021-03-17T15:55:53Z</dc:date>
    <item>
      <title>Transaction-like  login events</title>
      <link>https://community.splunk.com/t5/Knowledge-Management/Transaction-like-login-events/m-p/544225#M4956</link>
      <description>&lt;P&gt;Hi,&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;I have applications that log login events as multiple events.&lt;/P&gt;&lt;P&gt;Example:&lt;/P&gt;&lt;P&gt;&lt;FONT face="courier new,courier"&gt;[07B0:007E-19E8] 2021.03.17 11:59:01 Opened session for User Name/HEXP/HU (Release 8.0.2FP6)&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT face="courier new,courier"&gt;[07B0:007E-19E8] 2021.03.17 11:59:01 ATTEMPT TO ACCESS SERVER by User Name/HEXP/HU was denied&lt;/FONT&gt;&lt;BR /&gt;&lt;FONT face="courier new,courier"&gt;[07B0:007E-1408] 2021.03.17 11:59:01 Closed session for User Name/HEXP/HU Databases accessed: 0 Documents read: 0 Documents written: 0&lt;/FONT&gt;&lt;/P&gt;&lt;P&gt;This is an unsuccessful login event.&lt;/P&gt;&lt;P&gt;when the login is successful, only the first event is logged. I can connect these events with transaction, which is ok for some reporting purposes. But if I use transaction then I can't tag these events and I can't make the logs CIM compliant.&lt;/P&gt;&lt;P&gt;Is there a way to handle these kind of situations?&amp;nbsp; Or it is not possible to tag these kind of events correctly?&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;&lt;P&gt;Thanks,&lt;/P&gt;&lt;P&gt;László&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Wed, 17 Mar 2021 15:55:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Knowledge-Management/Transaction-like-login-events/m-p/544225#M4956</guid>
      <dc:creator>nembela</dc:creator>
      <dc:date>2021-03-17T15:55:53Z</dc:date>
    </item>
  </channel>
</rss>

