How to get windows current user

[kengilmour]

Hi,

We have logs from all of our Windows and Linux Servers and Workstations and I would like to create a table daily to help analyse historical logs.

What I would like to get from the Windows Logs (Currently System, Security and Application Logs) is the currently logged-on user, time of logon and logoff, and IP address and Machine Name.

These are all in various Windows logs, but before I try to put it all together I was wondering if anyone here has already done this?

Thanks!

Ken

[ahall_splunk]

Have you tried the Splunk App for Active Directory? This contains the information you are looking for and normalizes both the NT5 and NT6 logs. Also, it creates a temporal lookup of IP address to machine name for you.

You can get it here: http://splunk-base.splunk.com/apps/51338/splunk-app-for-active-directory