Splunk Search

Remote desktop user

gjhaaland
Explorer

Hi,

The code is like

index=main host=server10 (EventCode=4624 OR  EventCode=4634) Logon_Type=3 NOT user="*$" NOT user "ANONYMOUS LOGON"

| dedup user | where NOT MsgID==AUT22673 | eval LoginTime=_time | table user LoginTime

 

The output will list active RDP user.  No idea how to fix the rest of it, either

1: If number of user == 0, then print "No Remote desktop user"

2: Or put number of user into a Single Value, Radial Gauge (not username)

Sounds so easy but I cannot figure out how to fix it.  Too little Splunk experience.

Rgds

Geir

Labels (1)
0 Karma

gjhaaland
Explorer

Thanks

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Do you just need a count of (distinct) users?

| stats dc(user) as users
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...