Getting Data In

How to fetch the user details who are all logged in the server at a particular time

thahir
Path Finder

How to fetch the user details who are all logged in the server at a particular time

Tags (1)
0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

Use the windows ta to ingest the windows security event log and look for EventCodes 4624, 4634, and 4647.

“Windows Security Log Event ID 4624. This is a highly valuable event since it documents each and every successful attempt to logon to the local computer regardless of logon type, location of the user or type of account. You can tie this event to logoff events 4634 and 4647 using Logon ID” - google result

View solution in original post

0 Karma

jkat54
SplunkTrust
SplunkTrust

Use the windows ta to ingest the windows security event log and look for EventCodes 4624, 4634, and 4647.

“Windows Security Log Event ID 4624. This is a highly valuable event since it documents each and every successful attempt to logon to the local computer regardless of logon type, location of the user or type of account. You can tie this event to logoff events 4634 and 4647 using Logon ID” - google result

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The Splunk server or one monitored by Splunk? What details?

---
If this reply helps you, Karma would be appreciated.
0 Karma

thahir
Path Finder

Monitored by splunk

0 Karma

richgalloway
SplunkTrust
SplunkTrust

What details are you looking for? Are you indexing login and logoff events from the server?

---
If this reply helps you, Karma would be appreciated.
0 Karma

thahir
Path Finder

Logoff events from the server

0 Karma

jkat54
SplunkTrust
SplunkTrust

Windows or Linux?

0 Karma

thahir
Path Finder

Windows

0 Karma

thahir
Path Finder

Windows

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...