Security

Need user logon events for 12 months

Explorer

Hi,

Following query displays user logon events for the last 10 days. We need user logon events for the last 12 months. How can this be achieved.

index=main sourcetype=WinEventLog (EventCode=4624 OR EventCode=4634) user=pratapa.ln
| eval day=strftime(_time,"%d/%m/%Y") | stats earliest(_time) AS earliest latest(_time) AS latest by user host day
| eval earliest=strftime(earliest,"%d/%m/%Y %H.%M.%S"), latest=strftime(latest,"%d/%m/%Y %H.%M.%S")

Labels (1)
0 Karma

Legend

Hi @pratapa,
you can use the Time Picke,r setting as option "Relative Time" and choosing "Last 12 months".
Otherwise, you can add to you main search earliest=-12mon.

Obviously it will be a very slow search that I suggest to put in background to avoid that it will go in timeout.
When it will be finished, you can resume it in Activities; in addition you can configure an email sending at the end.

Ciao.
Giuseppe

0 Karma

Explorer

Thanks for your response.

We incorporated earliest=-12mon in the query. But still It is displaying logon events for the last 10 days.

index=main sourcetype=WinEventLog (EventCode=4624 OR EventCode=4634) user=pratapa.ln earliest=-12mon
| eval day=strftime(_time,"%d/%m/%Y") | stats earliest(_time) AS earliest latest(_time) AS latest by user host day
| eval earliest=strftime(earliest,"%d/%m/%Y %H.%M.%S"), latest=strftime(latest,"%d/%m/%Y %H.%M.%S")

User wants the data to be retained for 12 months. To achieve this, we have created a new index with the name "retention" with the following parameters.

[retention]
coldPath = $SPLUNK_DB/retention/colddb
homePath = $SPLUNK_DB/retention/db
thawedPath = $SPLUNK_DB/retention/thaweddb
maxDataSize = 150
maxHotSpanSecs = 86400
maxTotalDataSizeMB = 54000
frozenTimePeriodInSecs = 31104000

How can we modify the query to retain the logon events for 12 months.

0 Karma