Splunk Search

How to pull RDP Connections in my environment?

Cyberguru
Engager

Query doesnt bring up anything.

Try to pull RDP connections in my environment: 

 

 

event_simpleName=UserLogon LogonType_decimal=10

| stats values(UserName) dc(UserName) AS "User Count" count(UserName) AS "Logon Count" by aid, ComputerName

| sort - "Logon Count"

 

Labels (4)
Tags (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

First, illustrate your raw data.  Are "aid" and "ComputerName" available at search time, AND are they present in (at least some of) the same events?  For example, what does this give you?

event_simpleName=UserLogon LogonType_decimal=10
| table aid, ComputerName

Also, the search appears to be about user name.  How does this relate to "pulling RDP connections" in the title?

View solution in original post

0 Karma

Cyberguru
Engager

Thanks for the answer

0 Karma

yuanliu
SplunkTrust
SplunkTrust

First, illustrate your raw data.  Are "aid" and "ComputerName" available at search time, AND are they present in (at least some of) the same events?  For example, what does this give you?

event_simpleName=UserLogon LogonType_decimal=10
| table aid, ComputerName

Also, the search appears to be about user name.  How does this relate to "pulling RDP connections" in the title?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...