topic Re: Windows Logon_Type in Splunk Search

Windows Logon_Type

geekf — Wed, 09 Dec 2020 13:26:59 GMT

When I am running this search I am not getting the results for EventType=4769:

index=main (EventCode=4634 OR EventCode=4624 OR EventCode=4769) Logon_Type!=3

If I run the search index=main (EventCode=4769) OR Logon_Type!=3 I get the results for 4769.

What can I do with the first search to include the results for 4769?

Thanks in advance!

Re: Windows Logon_Type

gcusello — Wed, 09 Dec 2020 13:46:58 GMT

Hi @geekf,

maybe you haven't events with EventCode=4769 AND Logon_Type=3.

To be sure, try this:

index=main EventCode=4769 Logon_Type=3

have you results?

Ciao.

Giuseppe

Re: Windows Logon_Type

geekf — Thu, 10 Dec 2020 07:33:04 GMT

Hi @gcusello

Thank you for your prompt response. I am getting results with this search:

index=main (EventCode=4769) OR Logon_Type!=3

I managed to solve it by using NOT instead of !=.

index=main (EventCode=4634 OR EventCode=4624 OR EventCode=4769) Logon_Type!=3

The above search is not giving me the results; however, if I use this search, it works fine:

index=main (EventCode=4634 OR EventCode=4624 OR EventCode=4769) NOT Logon_Type=3

Here is what was causing this issue:

If you search with the != expression, every event that has a value in the field, where that value does not match the value you specify, is returned. Events that do not have a value in the field are not included in the results.

If you search with the NOT operator, every event is returned except the events that contain the value you specify. This includes events that do not have a value in the field.

https://docs.splunk.com/Documentation/Splunk/8.1.0/Search/NOTexpressions

Thank you!

Re: Windows Logon_Type

gcusello — Thu, 10 Dec 2020 07:19:52 GMT

HI @geekf,

good for you!

Please accept the answer for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉