How can I pull all the service name in a list?

[leonuz01]

Hi, I need help!

I have this query.

Ticket_Encryption_Type=0x17 Account_Domain="ad.contoso.com"

but I need, pull all the Service name in a list.

how can I do that?

thanks  

07/26/2023 12:31:30 PM

LogName=Security

EventCode=4769

EventType=0

ComputerName=a-dc1.ad.contoso.com

SourceName=Microsoft Windows security auditing.

Type=Information

RecordNumber=1125639551

Keywords=Audit Success

TaskCategory=Kerberos Service Ticket Operations

OpCode=Info

Message=A Kerberos service ticket was requested.

Account Information:

Account Name: team_explorer@ad.contoso.com

Account Domain: ad.contoso.com

Logon GUID: {XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX}

Service Information:

Service Name: NAME-ONE$

Service ID: S-X-X-XX-XXXXXXXXX-XXXXXXXXXX-XXXXXXXXX-XXXXX

Network Information:

Client Address: ::ffff:192.168.8.49

Client Port: 41365

Additional Information:

Ticket Options: 0x810000

Ticket Encryption Type: 0x17

Failure Code: 0x0

Transited Services: -

[richgalloway · Accepted solution]

It depends on the what you want the output to look like.  This will give you a list of Service Names and a count of how many of each were found.

index=foo Ticket_Encryption_Type=0x17 Account_Domain="ad.contoso.com"
| stats count by Service_Name