I want to identify the login and logouts for each user on a server.
I use the event_id 4624 (logon) and 4634(logoff). the problem is that Windows generates multiple events for only one login/logoff.
It seems that they share the same login_id.
so I try something like:
host="server a" user="allice" (EventCode=4624 OR EventCode=4624 )
now I need something like:
| where login_id= login_id
So that I get only 2 events for one login/logoff , but for all users and over time 🙂
Are you sure your not seeing multiple events for logintype3 or logintype4 which are network or service logons - its quite conceivable you would see lots of these during login (and use) as you system downloads profiles/maps drives etc.
If you restrict your search to LoginType2 (interactive) you may have more concise results.
I am not near Splunk at the moment, so this may not work off the hop, but this might get you closer.
((EventCode=4624 (Logon_Type=2 OR login_Type=7 OR Login_Type=10)) OR (EventCode=4634 OR EventCode=4647) )|transaction user, host startswith="EventCode=4624"
edited to include loging type7 (unlock) and 10 (remote desktop)