Getting Data In

How do I generate a report listing x sample events for each Windows event code?

vhaabqdeltoj
New Member

I need to generate a report showing X entries for each type of Windows event code I have. The report would look something like:

Event Code: X (say 4624 for example)

<most recent event with an Event Code of 4624>
<second most recent event and Event Code of 4624>
<<n> most recent event with an Event Code of 4624> where <n> is equal to X above (say 10 for example)

Event Code: Y (say 4625 for example)

<most recent event with an Event Code of 4624>
<second most recent event and Event Code of 4624>
<<n> most recent event with an Event Code of 4624> where <n> is equal to X above (say 10 for example)

0 Karma

sundareshr
Legend

Like this

| streamstats count by EventCode | stats count list(Message) by EventCode | where count <= 5
0 Karma

vhaabqdeltoj
New Member

Thank you. That was very helpful but it left me with one little perplexing problem. During the search, it displays the EventCode and the messages. It looks perfect. Then it gets to "finalizing search". When the search become final, it erases the display and says "no results found". There are events and I could see the results as it was building the search. Any ideas why this happens?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Build the Future of Agentic AI: Join the Splunk Agentic Ops Hackathon

AI is changing how teams investigate incidents, detect threats, automate workflows, and build intelligent ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...