Splunk Search

How do I filter out events from two separate event codes with similar fields?

urasplunkronbur
New Member

I'm trying to determine which Windows workstations a user is currently logged in to by:

  • Examining logs from our Domain Controllers with Event Codes 4624 (An account was successfully logged on) and 4634 (An account was logged off)
  • filtering them against that user's ID
  • looking for similar Logon_ID fields from both types of events
  • and then deleting those values, as well as, the remaining 4634 events.

This technically should give me a report showing only logons by this user with no correlated logoff, but I'm unsure how to create this query.

Any help would be appreciated, and if there's a better method for solving this problem, I'm open to anything.

Thanks.

0 Karma

woodcock
Esteemed Legend

Like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo AND (EventCode="4624" OR EventCode="4634")
| streamstats count(eval(EventCode="4634")) AS sessoinID BY Logon_ID
| stats dc(EventCode) AS numEventCodes BY Logon_ID
| where numEventCodes<2
0 Karma

urasplunkronbur
New Member

Thank you for the response! The results look great, I'm new to Splunk and trying to learn the ropes, so help is much appreciated.

Unfortunately, we are having to rebuild the heavy forwarder due to the fact that many events passed from our windows logs are being dropped. This results in not completely reliable data, so although logically your solution should work, we still sometimes have logoff events that do not have a related logon event. Is there a way, once the distinct count and where clause have executed, to filter out the remaining 4634 events?

Thanks.

0 Karma

woodcock
Esteemed Legend

Sure, just change the last 2 lines to this:

| stats dc(EventCode) AS numEventCodes values(EventCode) AS EventCodes BY Logon_ID
| where numEventCodes<2 AND EventCodes="4363"
0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...