Looking to query a domain account and find out the device it is logged into or running on

[Sotu]

I wrote a simple query to parse my Windows Event Security logs to look for a user account, however I am looking to add onto this and find out which devices the accounts are running on.

index="wineventlog" source="WinEventLog:Security" user="domainaccount"

My end goal is to be able to type in a domain account in my search and find what device its associated with or is running as a service under.  

[Sotu]

Thanks! I am still learning Splunk and will modify my query to check for the events.

[deepakc]

You normally need to find the events that show you the data, so these need to be logged first and then into Splunk, so check to see if the below events are there and search for those based on the user.

Search for eventid field - I cant remeber the exact name, but it should be there.

The below events many help find the data you are looking for for others check on Google plenty there. 

EventCode=4624: Successful user logon (interactive logon).
EventCode=4625: Failed user logon attempt.
EventCode=4648: Logon using explicit credentials (e.g., "Run As" or services).