Search WinEventLogs based on user as Variable

cam98 — Sat, 31 Oct 2020 13:39:58 GMT

Hi,

I'm new to Splunk & just getting used to it. I'm trying to search for Windows event logs relative to the "TargetUserName" field in the logs. I'm trying to run a search that shows me user accounts that have had two different event logs associated with it in a 7 day period.

The search i'm looking to run is: if a user has had event code 4724 generated and then has event code 4740 occur within 7 days after code 4724 was seen. I was thinking i'd have to define the user name as variable that bring back the results if the event code conditions match (as described above.

Or could there be a better way of going about this?

Any help is appreciated. Thanks.

Re: Search WinEventLogs based on user as Variable

inventsekar — Sun, 01 Nov 2020 00:01:58 GMT

Hi @cam98 ... all you need is a "Transaction" command (it will work on group of events, we can specify the start and end of the group)...

the approximate query.. please edit the indexname, sourcetype name as per your design..

index=indexName sourcetype="WinEventLog:Security:VERIFY:this" EventCode=4740 OR EventCode=4771 | transaction startswith=eval(EventCode=4771) endswith=eval(EventCode=4740) maxspan=7d maxevents=15

~Happy Splunking | Best Regards | Sekar | PS - Karma points appreciated!

topic Re: Search WinEventLogs based on user as Variable in Splunk Search

Search WinEventLogs based on user as Variable

Re: Search WinEventLogs based on user as Variable