Good morning,
I'm doing a search to bring users and their first login of the day and their last logoff.
I made the following query but I cannot get the first line of the 4624 and the last one of the 4636 in the same line.
index=wineventlog (EventCode="4624" OR EventCode="4634") Account_Name="Agustina.Sanabria"
| regex Account_Name!=".*\$"
| eval day=strftime(_time,"%d/%m/%Y")
| eval User=if(EventCode="4624",mvindex(Account_Name,1),Account_Name)
| stats earliest(_time) as PrimerLogin, latest(_time) as UltimoLogoff by User EventCode host day
| eval PrimerLogin=strftime(PrimerLogin,"%d/%m/%Y %H.%M.%S"), UltimoLogoff=strftime(UltimoLogoff,"%d/%m/%Y %H.%M.%S")
| sort User
Tks, sorry for my english
Your line 4
is a problem, You need to split the Account_Name
in order to use the mvindex
. I tried with a dummy data set. Let me know if it works.
| makeresults
| eval EventCode="4624 4634" | eval host=host1
| makemv delim=" " EventCode
| mvexpand EventCode
| eval Account_Name="Agustina.Sanabria"
| regex Account_Name!=".*\$"
| eval day=strftime(_time,"%d/%m/%Y")
| eval User=if(EventCode="4624",mvindex(split(Account_Name,"."),1),Account_Name)
| stats earliest(_time) as PrimerLogin, latest(_time) as UltimoLogoff by User EventCode day host
| eval PrimerLogin=strftime(PrimerLogin,"%d/%m/%Y %H.%M.%S"), UltimoLogoff=strftime(UltimoLogoff,"%d/%m/%Y %H.%M.%S")
| sort User
I converted this from an answer to an old question into its own question.