Results on one value matching two AND field results

[chrisschum]

I'm trying to figure out a way to find out if an unknown user name matches two Windows Event Codes for a dashboard.

I want to search if a userID (Account_Name) matches both Event Codes 4740 and 4625, so that I can create a simple dashboard where you can input a userID and the results will only show those that match both codes above.

Thanks!

[dragonakai · Accepted solution]

I recommend something like this. You can manipulate it further to make the formatting pretty or easy to read. You could also attempt a transaction, but I think this will be faster. Also, you will want to mess with the span in the bin command. 5 minutes may be too small. You could make that a token for a dashboard input, like with userid.

sourcetype=wineventlog* Account_Name=$userid$ EventCode=4740 OR EventCode=4625
| bin _time span=5m
| stats values(Message) values(EventCode) AS EventCodes by _time
| eval EventCodeCount=mvcount(EventCodes)
| search EventCodeCount=2

[chrisschum]

That worked like a champ! Thanks!