Show results only when EventCodes occur in a specific sequence

[wgawhh5hbnht]

I'm attempting to find events when EventCodes occur in 1, 3, 13, then 4689. (Detection of psexec via windows logs). Here is what I've come up with:

index=windows (EventCode=1 OR EventCode=3 OR EventCode=13 OR EventCode=4689)
 | streamstats count(eval(EventCode="1" OR EventCode="3" OR EventCode="13" OR EventCode=4689)) AS sessionID BY host
 | transaction host startswith=1 endswith=4689

The problem is the search takes forever to complete and either we don't have any psexec running in the environment or the search isn't correct. Can someone take a look at the logic to determine if I'm on the right path, if this returns any results, & if there is a better way to search for this? Thank you in advance!

[Sukisen1981]

if you remove everything after the first pipe , is the search executing for just index=windows (EventCode=1 OR EventCode=3 OR EventCode=13 OR EventCode=4689) ?
if that is taking too long , can you try these 2 options?
index=windows |fields EventCode|where (EventCode=1 OR EventCode=3 OR EventCode=13 OR EventCode=4689)
OR
index=windows EventCode=|where (EventCode=1 OR EventCode=3 OR EventCode=13 OR EventCode=4689)

does it make a difference?

[wgawhh5hbnht]

The portion that takes a long time is
| transaction host startswith=1 endswith=4689

[Sukisen1981]

hi @wgawhh5hbnht
can you post a sample event? your command looks ok I am reasonably sure the event structure is different from what I am visualising atm.
PS - One tongue twister of a username 🙂 🙂