Splunk Search

Remote desktop user

gjhaaland
Explorer

Hi,

The code is like

index=main host=server10 (EventCode=4624 OR  EventCode=4634) Logon_Type=3 NOT user="*$" NOT user "ANONYMOUS LOGON"

| dedup user | where NOT MsgID==AUT22673 | eval LoginTime=_time | table user LoginTime

 

The output will list active RDP user.  No idea how to fix the rest of it, either

1: If number of user == 0, then print "No Remote desktop user"

2: Or put number of user into a Single Value, Radial Gauge (not username)

Sounds so easy but I cannot figure out how to fix it.  Too little Splunk experience.

Rgds

Geir

Labels (1)
0 Karma

gjhaaland
Explorer

Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you just need a count of (distinct) users?

| stats dc(user) as users
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...