topic How do i use eval to calculate two fields? in Splunk Search

How do i use eval to calculate two fields?

FYPTEST — Wed, 27 Jan 2021 16:48:04 GMT

What I am trying to accomplish with the command is to find the events with the EventCode "4624" and Logon_Type "10" or "2", and to name them as "RDP", however i get the following error:

Here is the query below:

index=wineventlogsecurity source=xmlWinEventLog:Security | stats count(eval(EventCode="4624") AND (Logon_Type="10")) AS RDP

Then I get this error:

Error in 'stats' command: The eval expression for dynamic field 'eval(EventCode="4624") AND (Logon_Type="10")' is invalid. Error='The operator at ') AND (Logon_Type="10"' is invalid.'.

Thanks in advance for any help! and apologies for the newbie questions as I am rather new to Splunk.

Re: How do i use eval to calculate two fields?

ITWhisperer — Wed, 27 Jan 2021 17:07:22 GMT

index=wineventlogsecurity source=xmlWinEventLog:Security EventCode="4624" (Logon_Type="10" OR Logon_Type="2") | stats count AS RDP

Re: How do i use eval to calculate two fields?

manjunathmeti — Wed, 27 Jan 2021 17:36:35 GMT

hi @FYPTEST ,
AND and OR operators should be in the eval function. Check this,

index=wineventlogsecurity source=xmlWinEventLog:Security | stats count(eval(EventCode="4624" AND (Logon_Type="10" OR Logon_Type="2"))) AS RDP

If this reply helps you, an upvote/like would be appreciated.