topic How do I filter out events from two separate event codes with similar fields? in Splunk Search

How do I filter out events from two separate event codes with similar fields?

urasplunkronbur — Fri, 08 Feb 2019 17:02:13 GMT

I'm trying to determine which Windows workstations a user is currently logged in to by:

Examining logs from our Domain Controllers with Event Codes 4624 (An account was successfully logged on) and 4634 (An account was logged off)
filtering them against that user's ID
looking for similar Logon_ID fields from both types of events
and then deleting those values, as well as, the remaining 4634 events.

This technically should give me a report showing only logons by this user with no correlated logoff, but I'm unsure how to create this query.

Any help would be appreciated, and if there's a better method for solving this problem, I'm open to anything.

Thanks.

Re: How do I filter out events from two separate event codes with similar fields?

woodcock — Fri, 08 Feb 2019 17:19:33 GMT

Like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo AND (EventCode="4624" OR EventCode="4634")
| streamstats count(eval(EventCode="4634")) AS sessoinID BY Logon_ID
| stats dc(EventCode) AS numEventCodes BY Logon_ID
| where numEventCodes<2

Re: How do I filter out events from two separate event codes with similar fields?

urasplunkronbur — Fri, 08 Feb 2019 19:10:11 GMT

Thank you for the response! The results look great, I'm new to Splunk and trying to learn the ropes, so help is much appreciated.

Unfortunately, we are having to rebuild the heavy forwarder due to the fact that many events passed from our windows logs are being dropped. This results in not completely reliable data, so although logically your solution should work, we still sometimes have logoff events that do not have a related logon event. Is there a way, once the distinct count and where clause have executed, to filter out the remaining 4634 events?

Thanks.

Re: How do I filter out events from two separate event codes with similar fields?

woodcock — Fri, 08 Feb 2019 19:15:49 GMT

Sure, just change the last 2 lines to this:

| stats dc(EventCode) AS numEventCodes values(EventCode) AS EventCodes BY Logon_ID
| where numEventCodes<2 AND EventCodes="4363"