I have a requirement to write a Splunk query that will alert if windows event logs capture three EventCodes (independent events) within 30 secs
"EventCode= X, Y, Z| bucket span=30s _time | fields _time hostname EventCode"
Any leads, please?
index=(your inddex) (EventCode= 4624 OR EventCode= 4672 EventCode= 4676)
| bucket span=30s _time | stats dc(EventCode) as count by _time,hostname|where count=3
View solution in original post