Splunk Search

Count of computers user triggered event code to by count of events of that event code

Mckechnie
Engager

Hi All,

I am trying to find:

Users using event code 4769

The count of computers a user connects to within 1hr which is greater >4
The count of the event code 4769 >50 by that user within 1hr

I have got myself very confused any help would be appreciated! 

 

 

sourcetype = windowseventcodes Event_Code=4769
| bucket _time span=1h 
| stats count by ComputerName AccountName
| stats count(ComputerName) as CNC by AccountName 
| eventstats sum(CNC) as total_count

 

 

 

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
sourcetype = windowseventcodes Event_Code=4769
| bucket _time span=1h 
``` count events by computer name and account within 1hr bins ```
| stats count by ComputerName AccountName _time
``` count computers user has used and total events for user within 1hr bins ```
| stats count(ComputerName) as CNC sum(count) as total_count by AccountName _time
``` select the rows you want ```
| where CNC > 4 AND total_count > 50

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
sourcetype = windowseventcodes Event_Code=4769
| bucket _time span=1h 
``` count events by computer name and account within 1hr bins ```
| stats count by ComputerName AccountName _time
``` count computers user has used and total events for user within 1hr bins ```
| stats count(ComputerName) as CNC sum(count) as total_count by AccountName _time
``` select the rows you want ```
| where CNC > 4 AND total_count > 50
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

What Is Splunk? Here’s What You Can Do with Splunk

Hey Splunk Community, we know you know Splunk. You likely leverage its unparalleled ability to ingest, index, ...

Level Up Your .conf25: Splunk Arcade Comes to Boston

With .conf25 right around the corner in Boston, there’s a lot to look forward to — inspiring keynotes, ...

Manual Instrumentation with Splunk Observability Cloud: How to Instrument Frontend ...

Although it might seem daunting, as we’ve seen in this series, manual instrumentation can be straightforward ...