Splunk Search

Request for Assistance


Hi Community,

I'm new to this world. I saw some very helpful people helping out new starters so I gathered courage to ask a question. 


I was hoping to modify the query to give me a nice visualization of RDP Activity focusing only on the 1149 Events. 




index="xxxx" LogName="Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" EventCode=1149| eval time=strftime(_time,"%Y-%m-%dT%H:%M:%SZ") | rex field=_raw ".*User:\s+(?<User>.*)\r\n" | rex field=_raw ".*Domain:\s+(?<Domain>.*)\r\n" | rex field=_raw ".*Network\sAddress:\s+(?<IP>.*)" | table host, time, User, Domain, IP




This gives me a very pretty tabular format of RDP attempts (not confirmed successful logins at times, but will do) 

How could I possibly edit the query in Github to cater to my needs? 

Apart from this, is there a way we can visualize (4624?) or Lateral Movement in the form of a picture/timeline using Splunk?

Thank you,


Labels (4)
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!