Matching events by pair

[timbCFCA]

I'm attempting to map when the count of two event IDs - 4634 and 4624 is different over a time period. These events correlate to logon (4624) and logoff (4634) events.

host=myhost* ( evtid=4634 OR evtid=4624 ) | counttable evtuser, evtid

This works perfectly if the start time does not site between when user logs on and logs off.

I would like to exclude any logoffs which occur prior to the first logon event. I have no idea of the syntax required to do so however.

I was also thinking of a slightly more sophisticated method. I have an additional field - LogonID which uniquely correlates these events in a 1:1 mapping. I'm thinking that it should be possible to exclude the last first logoff event if the first logon event does not have the same LogonID value. My guess is that is more work than is necessary however.

[Drainy · Accepted solution]

Well I have just quickly thrown together a transaction on my system to see if it would work. I think it does what you are after..

event_id=4634 OR event_id=4624 | transaction Account_Name ComputerName startswith="EventCode=4634" endswith="EventCode=4624"  keepevicted=true | search  closed_txn=0 | stats count

Obviously you could modify this to meet your exact needs but this will transaction events based on them starting with a logon and ending with a logoff. I choose to keep the events that don't fit in the transaction and then only display them, I can then count them. You could here count by event id or user name etc. If the logonID is in each event you could also transaction based on that.

[timbCFCA]

On first glance that definitely looks like what I need. Many thanks.