Splunk Search

Count of computers user triggered event code to by count of events of that event code

Mckechnie
Engager

Hi All,

I am trying to find:

Users using event code 4769

The count of computers a user connects to within 1hr which is greater >4
The count of the event code 4769 >50 by that user within 1hr

I have got myself very confused any help would be appreciated! 

 

 

sourcetype = windowseventcodes Event_Code=4769
| bucket _time span=1h 
| stats count by ComputerName AccountName
| stats count(ComputerName) as CNC by AccountName 
| eventstats sum(CNC) as total_count

 

 

 

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
sourcetype = windowseventcodes Event_Code=4769
| bucket _time span=1h 
``` count events by computer name and account within 1hr bins ```
| stats count by ComputerName AccountName _time
``` count computers user has used and total events for user within 1hr bins ```
| stats count(ComputerName) as CNC sum(count) as total_count by AccountName _time
``` select the rows you want ```
| where CNC > 4 AND total_count > 50

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
sourcetype = windowseventcodes Event_Code=4769
| bucket _time span=1h 
``` count events by computer name and account within 1hr bins ```
| stats count by ComputerName AccountName _time
``` count computers user has used and total events for user within 1hr bins ```
| stats count(ComputerName) as CNC sum(count) as total_count by AccountName _time
``` select the rows you want ```
| where CNC > 4 AND total_count > 50
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...