Dashboards & Visualizations

After Hour login query/dashboard

bluemarvel
Path Finder

Hello I am looking to set up a dashboard to monitor or an alert that will help track after hour log ins. Any suggestions
the query will use windows log in events codes.

thank you in advance

Tags (1)
0 Karma

jrprez1804
Path Finder

date_hour>=17 OR date_hour<=8 | stats count by user

adonio
Ultra Champion

you can start with something basic, assuming after hours are 5:00pm - 8:00am

earliest= @d-7h latest=@d+8h index= sourcetype= EventCode = 4624 | stats count by user
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...