How do I search if a windows Event code xxxx from the Security logs is being ingested into Splunk?

[SamHTexas]

Please share a SPL to show if a certain event code ( Windows) from Security logs is being ingested into Splunk. I appreciate a response in advance.

[PickleRick]

What do you mean by "is being"? Because a question for a simple field=value search seems a bit lazy 😉

[SamHTexas]

I mean a certain event code is being pulled into Splunk so we see it in the event logs. Thank u

[gcusello]

Hi @SamHTexas,

as @PickleRick said, you have only to add a simple filter to your main search, so e.g. if you want to find the login, logout and logfail events:

index=wineventlog (EventCode=4624 OR EventCode=4625 OR EventCode=4634=
| ...

The only problem is identify the EventCodes that you need.

Ciao.

Giuseppe