Getting Data In

Why is my timestamp not working in Windows event logs?

Communicator

Here is my search

index=wineventlog Account_Domain=* ("EventCode=4625" OR "EventCode=4740") | stats count count(eval(EventCode=4740)) as LockedCount by user Account_Domain | search count>3 | eval Locked=if(LockedCount>1, "Yes", "No") | table _time user count Account_Domain Locked | rename user as "User" count as "Failed Authentication Attempts" Account_Domain as "Domain"

When I look at the log raw data, there is clearly a time stamp.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

The stats command is only passing the count, LockedCount, user, and Account_Domain fields to downstream commands so there is no _time to display. Try using either eventstats or streamstats.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

The stats command is only passing the count, LockedCount, user, and Account_Domain fields to downstream commands so there is no _time to display. Try using either eventstats or streamstats.

---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

Communicator

Okay, that made it work. Why is count in there twice?

streamstats count count(eval...)

(I used this code snipped from another Splunk answer)

0 Karma

SplunkTrust
SplunkTrust

The first counts all events and the second counts only those events where EventCode=4740.

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Esteemed Legend

What is your inputs.conf for this?

Are your indexers using NTP? Do you have the TZ settings correct for this input?

0 Karma

Communicator

My time zone settings are correct, as other inputs are correctly recording time.

If I remove most of the search string like this

index=wineventlog Account_Domain=* | table _time

The time shows up perfectly.

0 Karma

Communicator

When I add in the | stats part is when it seems to break

index=wineventlog Account_Domain=* ("EventCode=4625" OR "EventCode=4740") | stats count count(eval(EventCode=4740)) as LockedCount by user Account_Domain | table _time

Shows no results

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!