Splunk Search

How to search windows interactive logon from the Authentication data model?

Path Finder

Hi there,

Is it possible to search for windows interactive logons from the Authentication data model?

eg. I can do it this way:

index=* source="*WinEventLog:Security" LogonType=2 OR LogonType=10 OR LogonType=11

And I'm looking for an equivalent way using a data model eg:

| tstats summariesonly=true count from datamodel=Authentication by Authentication.action Authentication.app Authentication.dest Authentication.signature Authentication.src Authentication.src_user Authentication.user
|search <SOME LOGIC>

Thank you!

Labels (1)
Tags (2)
0 Karma


@dbroggy - The Authentication data model does not have a field called "LogonType". 

  • You can clone the Authentication data model and add this additional field for your use case.

If this is the only query and performance is not a big problem I would suggest writing a regular query rather than creating a cloned version of data model as that will create additional search loads on Splunk servers.

If performance is a big problem you can use summary indexing or report acceleration as that would be much better for overall Splunk performance.

0 Karma

Ultra Champion

I don't see any fields in the datamodel which would map to the LogonType value. So you can't search for it from the existing datamodel. You'd have to make a copy of the datamodel and add new field to it.

But the question is whether there is a point since the CIM datamodels are meant to serve as a layer of abstraction separating the search using the datamodel from the gory details of particular data implementation. And your LogonType field is very implementation-specific. So from the data engineering point of view, it's not s pretty solution. If you want to have it only because you want to use data model acceleration, there are other ways to accelerate your searches.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...