Getting Data In

Why is my timestamp not working in Windows event logs?

Communicator

Here is my search

index=wineventlog Account_Domain=* ("EventCode=4625" OR "EventCode=4740") | stats count count(eval(EventCode=4740)) as LockedCount by user Account_Domain | search count>3 | eval Locked=if(LockedCount>1, "Yes", "No") | table _time user count Account_Domain Locked | rename user as "User" count as "Failed Authentication Attempts" Account_Domain as "Domain"

When I look at the log raw data, there is clearly a time stamp.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

The stats command is only passing the count, LockedCount, user, and Account_Domain fields to downstream commands so there is no _time to display. Try using either eventstats or streamstats.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

The stats command is only passing the count, LockedCount, user, and Account_Domain fields to downstream commands so there is no _time to display. Try using either eventstats or streamstats.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Communicator

Okay, that made it work. Why is count in there twice?

streamstats count count(eval...)

(I used this code snipped from another Splunk answer)

0 Karma

SplunkTrust
SplunkTrust

The first counts all events and the second counts only those events where EventCode=4740.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Esteemed Legend

What is your inputs.conf for this?

Are your indexers using NTP? Do you have the TZ settings correct for this input?

0 Karma

Communicator

My time zone settings are correct, as other inputs are correctly recording time.

If I remove most of the search string like this

index=wineventlog Account_Domain=* | table _time

The time shows up perfectly.

0 Karma

Communicator

When I add in the | stats part is when it seems to break

index=wineventlog Account_Domain=* ("EventCode=4625" OR "EventCode=4740") | stats count count(eval(EventCode=4740)) as LockedCount by user Account_Domain | table _time

Shows no results

0 Karma