How do you search Multiple users logged into a single machine at the same time?

[ITWhisperer]

This is a bit vague - what events are you dealing with (please provide anonymised samples)?

In general, you could assign log on events a value 1 and log off events a value -1, then do a streamstats summing these values and when the sum is above 1 you have multiple users logged on. You would have to take care of the issue of log off events appearing without a preceding log on event, and all this tell you is the change, you might want to consider setting your start time to be when there is known to be zero users logged on.

[Casial06]

So, I am searching for Multiple users logged into a single machine at the same time, or even within the same hour.

Initially this is my search query to display how many users log-on in 1 host.

index="windows" sourcetype="WinEventLog" EventCode=4624
| search host!="*$*"
| stats dc(user) as user_count by host

the problem is it does not count the current user since there's log off events. hope I explained that clearly. Thanks.

[ITWhisperer]

What is EventCode 4624? Is that a log on, a log off or either? If it is either, how do you distinguish between the two? If it is one or the other, which events signify the other event? Essentially, how can you tell from your data when a user logs on and when they log off?