Getting Data In

I need to get Windows event details

rahul_acc_splun
New Member

index="wineventlog" sourcetype="wineventlog:security" | search (action=failure OR action=success) | search (EventCode=4624 OR EventCode=4625 OR EventCode=4648 OR EventCode=4768 OR EventCode=4769 OR EventCode=4771 OR EventCode=4776) | stats dc(action) as action values(dest) as dest count by user | where action>1
This query is giving me the results for user who has successful success followed by failure but i am not able to check no of failures per destination can you please help me.
I want to have 1 coloum which would have failures number pertaining to user to respective destination.

0 Karma

niketn
Legend

@rahul_acc_splunk2, first off you need to tweak your search filters for better performance. Move 2nd and 3rd | search pipes to base search. Filtering results upfront in the base search will boost your query performance, otherwise you will carry unwanted events from one command to the next and then eventually filter them out.

index="wineventlog" sourcetype="wineventlog:security" (action=failure OR action=success) (EventCode=4624 OR EventCode=4625 OR EventCode=4648 OR EventCode=4768 OR EventCode=4769 OR EventCode=4771 OR EventCode=4776) 

After the filter command pipe the following stats command to get Success or Failure group by destinations and users.

| stats count(eval(action="success")) as SuccessCount count(eval(action="failure")) as FailureCount  by user dest
| search FailureCount>1

Only if you want list of all the destinations and just the count of Success vs Failure by user alone, you can use values(dest) and use by user as aggregate:

| stats count(eval(action="success")) as SuccessCount count(eval(action="failure")) as FailureCount  values(dest) as Destinations by user
| search FailureCount>1
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...