Splunk Search

How do I filter out events from two separate event codes with similar fields?

urasplunkronbur
New Member

I'm trying to determine which Windows workstations a user is currently logged in to by:

  • Examining logs from our Domain Controllers with Event Codes 4624 (An account was successfully logged on) and 4634 (An account was logged off)
  • filtering them against that user's ID
  • looking for similar Logon_ID fields from both types of events
  • and then deleting those values, as well as, the remaining 4634 events.

This technically should give me a report showing only logons by this user with no correlated logoff, but I'm unsure how to create this query.

Any help would be appreciated, and if there's a better method for solving this problem, I'm open to anything.

Thanks.

0 Karma

woodcock
Esteemed Legend

Like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo AND (EventCode="4624" OR EventCode="4634")
| streamstats count(eval(EventCode="4634")) AS sessoinID BY Logon_ID
| stats dc(EventCode) AS numEventCodes BY Logon_ID
| where numEventCodes<2
0 Karma

urasplunkronbur
New Member

Thank you for the response! The results look great, I'm new to Splunk and trying to learn the ropes, so help is much appreciated.

Unfortunately, we are having to rebuild the heavy forwarder due to the fact that many events passed from our windows logs are being dropped. This results in not completely reliable data, so although logically your solution should work, we still sometimes have logoff events that do not have a related logon event. Is there a way, once the distinct count and where clause have executed, to filter out the remaining 4634 events?

Thanks.

0 Karma

woodcock
Esteemed Legend

Sure, just change the last 2 lines to this:

| stats dc(EventCode) AS numEventCodes values(EventCode) AS EventCodes BY Logon_ID
| where numEventCodes<2 AND EventCodes="4363"
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...