Remote desktop user

gjhaaland — Wed, 15 Nov 2023 08:27:09 GMT

Hi,

The code is like

index=main host=server10 (EventCode=4624 OR EventCode=4634) Logon_Type=3 NOT user="*$" NOT user "ANONYMOUS LOGON"

| dedup user | where NOT MsgID==AUT22673 | eval LoginTime=_time | table user LoginTime

The output will list active RDP user. No idea how to fix the rest of it, either

1: If number of user == 0, then print "No Remote desktop user"

2: Or put number of user into a Single Value, Radial Gauge (not username)

Sounds so easy but I cannot figure out how to fix it. Too little Splunk experience.

Rgds

Geir

Re: Remote desktop user

ITWhisperer — Wed, 15 Nov 2023 09:41:30 GMT

Do you just need a count of (distinct) users?

| stats dc(user) as users

gjhaaland — Wed, 15 Nov 2023 10:31:45 GMT

Thanks