Getting Data In

Collecting logon/logoff logs from Active Directory

New Member

I am trying to get the Windows Infrastructure all configured. For the most part I think I have it configured right but something are not working. I would like to collect logon/logoff logs from AD.

I follow the docs about Windows Apps Infra and put Add-ons on my Splunkforwarder ( AD domain ) etc

Domains, domain controllers, Group policy and Organizational Units are found but DNS, Users and Groups are not found.

Any help to get this working would be appreciated.

Excuse my English


0 Karma

New Member

I found something about logs, i use Windows Server 2012 R2 in french and dashboards on Windows Infrastructure App don't read french logs so it didn't work.
Is there a way to resolve this ?



0 Karma

Esteemed Legend

Hi Djow,
Collecting logon/logoff from Windows is difficult because every access generates 10-12 events and there are many automatic accesses of services, so it's difficult to display the real accesses to systems.
I filtered taking

  • Login EventCode=4624 OR EventCode=524
  • Logfail EventCode=4625 OR EventCode=529
  • Logout EventCode=4647 OR EventCode=551 and
  • Logon_Type=2 OR Logon_Type=10) and making dedup for _time User host

Instead to have the active sessions I used a simple script for systems greater than 2008 seven:

@echo off
REM --------------------------------------
REM Controllo delle sessioni utente attive
REM --------------------------------------

REM Get event date and time
set date_time=%date% %time%

REM Print the event date and time, this will be the event timestamp
echo Current time: %date_time%

REM print the current user session
query user


0 Karma

New Member

When you say "DNS, Users and Groups" are not found, what do you mean exactly by that?
Did you activate a GPO to audit Logon/Logoff events?

0 Karma

New Member

On the installation for Windows Infrastructure , After checking data, the App detects features to collect and then disable DNS, Users, Computers and Groups
However, on the Eventviewer on my Windows(AD controller and domain) and on Splunk research , i see the " Event ID 4624" that correspond to logon/logoff.
GPO to audit Audit account logon events, account management, logon events and Powershell are activated.

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...