Splunk Enterprise

Windows Event Monitoring - Utilisation calculation logic

Dv_Nikhil
New Member

We have to calculate the Utilization of the system (PC\Laptop) based on the Windows events logs (4800 & 4801).

  • 4801 --> This log denomination indicates the system has been Unlocked
  • 4800 --> This log denomination indicates the system has been Locked

The time difference between the 4801 to 4800 events is considered as Utilization period.

As we are working on the Night shifts we have encountered a scenario where  we are receiving the 4801 event entry for that particular day  & 4800 entry never returns on the same day since the system will not be locked.

 

Hence we would need help in calculating the Utilization period for the users between 6pm to 4am. As there will be change in the date for the mentioned time frame, we are unable to calculate the Utilization for the day due to the aggregate functions.

Kindly provide us your suggestions which could be possible solution.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...