Count of computers user triggered event code to by count of events of that event code

[Mckechnie]

Hi All,

I am trying to find:

Users using event code 4769

The count of computers a user connects to within 1hr which is greater >4
The count of the event code 4769 >50 by that user within 1hr

I have got myself very confused any help would be appreciated! 

sourcetype = windowseventcodes Event_Code=4769
| bucket _time span=1h 
| stats count by ComputerName AccountName
| stats count(ComputerName) as CNC by AccountName 
| eventstats sum(CNC) as total_count

[ITWhisperer · Accepted solution]

sourcetype = windowseventcodes Event_Code=4769
| bucket _time span=1h 
``` count events by computer name and account within 1hr bins ```
| stats count by ComputerName AccountName _time
``` count computers user has used and total events for user within 1hr bins ```
| stats count(ComputerName) as CNC sum(count) as total_count by AccountName _time
``` select the rows you want ```
| where CNC > 4 AND total_count > 50