How to get current user from windows server (with username and count)?

[sam_kwon]

I'm using this code which gives me the information but I need current total users 

(index=* OR index=_*) (index=* OR index=_*) index=wineventlog "ComputerName=sample_server" "EventCode=4624" | fields "_time", "user" | dedup "user" 

(JFI -- I USED 15 MIN TIME FRAME)

[sam_kwon]

ok  make sense!

I read somewhere by using substring you can get the info. 

[bowesmana]

You have 3 odd index=... statements at the start in that you are searching *, _* and wineventlog. I suspect you just want index=wineventlog.

If you just want a count of the unique number of users in your search window, do this

index=wineventlog "ComputerName=sample_server" "EventCode=4624" 
| stats dc(user) as user_count

[sam_kwon]

actually I want current user so, I don't know event log work...

is there any other command to use to get current user in rdp or server 

[PickleRick]

Splunk does not work this way. You only analyze what data you have pushed from the forwarders. In case of windows you get login events, logout events. You can try to deduce from that who is currently logged in (for example by searching who logged in and hasn't logged out) but that's not checked directly at the source and is not a 100%-proof method (for example, if a user logged in but then the windows box crashed and had no means of logging a logout event you'll never know that the user is no longer logged in. You could have a scripted/modular input listing periodically users logged in at a given moment but that you'd have to create yourself.