- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How can I do a report of AD users logged in multiple pc at the same time?
msiri
Observer
08-25-2022
06:24 AM
how can i do a report of AD users logged in multiple pc at the same time? im trying to take a list of any user that has logged (event 4624) in more than one pc.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
![gcusello gcusello](https://community.splunk.com/legacyfs/online/avatars/553812.jpg)
gcusello
![SplunkTrust SplunkTrust](/html/@E48BE65924041B382F8C3220FF058B38/rank_icons/splunk-trust-16.png)
SplunkTrust
08-25-2022
07:19 AM
Hi @msiri,
you could try something like this:
index=wineventlog EventCode=4624
| timechart span=1m dc(host) AS host_count BY Account_name
| where host_count>1
you could also reduce the time frame to less than one minute.
Ciao.
Giuseppe
![](/skins/images/396DDBEEAC295EB5FEC41FF128E8AC0A/responsive_peak/images/icon_anonymous_message.png)