Hi,
Following query displays user logon events for the last 10 days. We need user logon events for the last 12 months. How can this be achieved.
index=main sourcetype=WinEventLog (EventCode=4624 OR EventCode=4634) user=pratapa.ln
| eval day=strftime(_time,"%d/%m/%Y") | stats earliest(_time) AS earliest latest(_time) AS latest by user host day
| eval earliest=strftime(earliest,"%d/%m/%Y %H.%M.%S"), latest=strftime(latest,"%d/%m/%Y %H.%M.%S")
Hi @pratapa,
you can use the Time Picke,r setting as option "Relative Time" and choosing "Last 12 months".
Otherwise, you can add to you main search earliest=-12mon
.
Obviously it will be a very slow search that I suggest to put in background to avoid that it will go in timeout.
When it will be finished, you can resume it in Activities; in addition you can configure an email sending at the end.
Ciao.
Giuseppe
Thanks for your response.
We incorporated earliest=-12mon in the query. But still It is displaying logon events for the last 10 days.
index=main sourcetype=WinEventLog (EventCode=4624 OR EventCode=4634) user=pratapa.ln earliest=-12mon
| eval day=strftime(_time,"%d/%m/%Y") | stats earliest(_time) AS earliest latest(_time) AS latest by user host day
| eval earliest=strftime(earliest,"%d/%m/%Y %H.%M.%S"), latest=strftime(latest,"%d/%m/%Y %H.%M.%S")
User wants the data to be retained for 12 months. To achieve this, we have created a new index with the name "retention" with the following parameters.
[retention]
coldPath = $SPLUNK_DB/retention/colddb
homePath = $SPLUNK_DB/retention/db
thawedPath = $SPLUNK_DB/retention/thaweddb
maxDataSize = 150
maxHotSpanSecs = 86400
maxTotalDataSizeMB = 54000
frozenTimePeriodInSecs = 31104000
How can we modify the query to retain the logon events for 12 months.