Help needed with Search to correlate Windows Event Logs

[rishiaggarwal]

Hi All,

I have a requirement to write a Splunk query that will alert if windows event logs capture three EventCodes (independent events) within 30 secs

PseudoQuery :
"EventCode= X, Y, Z| bucket span=30s _time | fields _time hostname EventCode"

Any leads, please?

[HiroshiSatoh · Accepted solution]

Try this!

index=(your inddex) (EventCode= 4624 OR EventCode= 4672 EventCode= 4676)
| bucket span=30s _time | stats dc(EventCode) as count by _time,hostname|where count=3