Getting Data In

Search for users who have triggered multiple Windows Event Codes

trevorQmulos
New Member

I am looking for a way to show users who have matched three separate Windows Security Event Codes

IE user X has (EventCode 1 AND EventCode 2 AND EventCode 3) OR ( EventCode 4 AND EventCode 5 AND EventCode 6)-> output the three event codes + username to a table.

When I try to just use AND between EventCode, it looks for both of the EventCode numbers in the single field and doesn't find any of the results.

0 Karma

jstoner_splunk
Splunk Employee
Splunk Employee

You could do it this way:

sourcetype=wineventlog* |stats values(EventCode) by ComputerName |rename values(EventCode) AS eventCodeList |search (eventCodeList=1002 AND eventCodeList=1004 AND eventCodeList=1006)

Basically I am pulling the values in the EventCode and grouping by ComputerName, I rename that field and then I do a subsearch for those 3 values in my initial result set. Depending on what you want the final result to look like, you may want to think about time frame, sequence of event codes and if you want to narrow your initial search to a smaller event code population to streamline the initial search. That said, hopefully this gets you on your way.

0 Karma

sundareshr
Legend

Try this

index=eventlogs (EventCode=1 OR EventCode=2 OR EventCode=3 OR EventCode=4 OR  EventCode=5 OR EventCode=6 | eval grp=if(EventCode=1 OR EventCode=2 OR EventCode=3, "Grp1", "Grp2") | chart values(EventCode) as ec by user grp | where (mvfilter(grp1, "1")>=0 AND mvfilter(grp1, "2")>=0 AND mvfilter(grp1, "3")>=0) OR (mvfilter(grp2, "4")>=0 AND mvfilter(grp2, "5")>=0 AND mvfilter(grp2, "6")>=0)
0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...