Getting Data In

Login Activity

itsmevic
Communicator

I need to check the logs against Workstation XYZ to ensure no one else besides JDOE has logged into it from 9/15/20 00:00:00.000  until 9/22/20. 23:59;59.999 (7-days).  What would be the best SPL to run to check this? 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @itsmevic,

if you're speking of windows logs, you should try something like this:

index=wineventlog EventCode=4624 workstation=XYZ user!=JDOE

please check if the fields workstation and user are written in your logs in this way, because I have an italian Windows and I have different fieldnames, but anyway you can see the approach.

Ciao.

Giuseppe

View solution in original post

itsmevic
Communicator

Thank you both! 

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @itsmevic,

if you're speking of windows logs, you should try something like this:

index=wineventlog EventCode=4624 workstation=XYZ user!=JDOE

please check if the fields workstation and user are written in your logs in this way, because I have an italian Windows and I have different fieldnames, but anyway you can see the approach.

Ciao.

Giuseppe

ITWhisperer
SplunkTrust
SplunkTrust

Search for login events where workstation = XYZ where user != JDOE

Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...