Please share a SPL to show if a certain event code ( Windows) from Security logs is being ingested into Splunk. I appreciate a response in advance.
What do you mean by "is being"? Because a question for a simple field=value search seems a bit lazy 😉
I mean a certain event code is being pulled into Splunk so we see it in the event logs. Thank u
as @PickleRick said, you have only to add a simple filter to your main search, so e.g. if you want to find the login, logout and logfail events:
index=wineventlog (EventCode=4624 OR EventCode=4625 OR EventCode=4634= | ...
The only problem is identify the EventCodes that you need.