Getting Data In

Login Activity

itsmevic
Communicator

I need to check the logs against Workstation XYZ to ensure no one else besides JDOE has logged into it from 9/15/20 00:00:00.000  until 9/22/20. 23:59;59.999 (7-days).  What would be the best SPL to run to check this? 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @itsmevic,

if you're speking of windows logs, you should try something like this:

index=wineventlog EventCode=4624 workstation=XYZ user!=JDOE

please check if the fields workstation and user are written in your logs in this way, because I have an italian Windows and I have different fieldnames, but anyway you can see the approach.

Ciao.

Giuseppe

View solution in original post

itsmevic
Communicator

Thank you both! 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @itsmevic,

if you're speking of windows logs, you should try something like this:

index=wineventlog EventCode=4624 workstation=XYZ user!=JDOE

please check if the fields workstation and user are written in your logs in this way, because I have an italian Windows and I have different fieldnames, but anyway you can see the approach.

Ciao.

Giuseppe

ITWhisperer
SplunkTrust
SplunkTrust

Search for login events where workstation = XYZ where user != JDOE

Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...