Splunk Search

Request for Assistance


Hi Community,

I'm new to this world. I saw some very helpful people helping out new starters so I gathered courage to ask a question. 


I was hoping to modify the query to give me a nice visualization of RDP Activity focusing only on the 1149 Events. 




index="xxxx" LogName="Microsoft-Windows-TerminalServices-RemoteConnectionManager/Operational" EventCode=1149| eval time=strftime(_time,"%Y-%m-%dT%H:%M:%SZ") | rex field=_raw ".*User:\s+(?<User>.*)\r\n" | rex field=_raw ".*Domain:\s+(?<Domain>.*)\r\n" | rex field=_raw ".*Network\sAddress:\s+(?<IP>.*)" | table host, time, User, Domain, IP




This gives me a very pretty tabular format of RDP attempts (not confirmed successful logins at times, but will do) 

How could I possibly edit the query in Github to cater to my needs? 

Apart from this, is there a way we can visualize (4624?) or Lateral Movement in the form of a picture/timeline using Splunk?

Thank you,


Labels (4)
0 Karma
Get Updates on the Splunk Community!

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...