Getting Data In

Sort results by time events

mysicksi
Path Finder

Hi everyone,

Can someone please help with a search I'm trying to create. My end goal is to capture which user account logged into the server and have a time associated with their login.

My search so far is below. This only gives me the count of how many times the users logged in for the past "x" days.

  index="wineventlog" host="Redacted" source="XmlWinEventLog:Security" | stats count by SubjectUserSid
0 Karma
1 Solution

to4kawa
Ultra Champion
0 Karma

to4kawa
Ultra Champion

use timechart

0 Karma

mysicksi
Path Finder

Thank you.

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>