Splunk Search

Searching ranges of event codes from windows event logs

LiquidTension
Path Finder

A user within my organization was attempting to search for various windows events that indicated that somebody modified a user's acccess on a machine or domain controller. Originally the search being used was the following:

(EventCode > 630 AND EventCode < 640) OR EventCode = 641 OR (EventCode > 647 AND EventCode < 668) OR (EventCode > 4726 AND EventCode < 4736) OR EventCode = 4737 OR (EventCode > 4743 AND EventCode < 4763) OR EventCode = 4764 OR (EventCode > 4782 AND EventCode < 4793)

This was not returning the range of event codes properly.

I modified the search accordingly and came up with this:

index=windows* sourcetype="WinEventLog:Security" (EventCode>="630" AND EventCode<="640") OR EventCode="641" OR (EventCode>="647" AND EventCode<="668") OR (EventCode>="4726" AND EventCode<="4736") OR EventCode="4737" OR (EventCode>="4743" AND EventCode<="4763") OR EventCode="4764" OR (EventCode>="4782" AND EventCode<="4793")

Thought I would share for people.

-Regards

1 Solution

LiquidTension
Path Finder

The following search returned more appropriate results for the user.

index=windows* sourcetype="WinEventLog:Security" (EventCode>="630" AND EventCode<="640") OR EventCode="641" OR (EventCode>="647" AND EventCode<="668") OR (EventCode>="4726" AND EventCode<="4736") OR EventCode="4737" OR (EventCode>="4743" AND EventCode<="4763") OR EventCode="4764" OR (EventCode>="4782" AND EventCode<="4793")

View solution in original post

splunknewbie81
Engager

Sorry to hijack this thread. 

Can someone please explain to me this string?

 

(EventCode>="630" AND EventCode<="640") OR EventCode="641" OR (EventCode>="647" AND EventCode<="668") OR (EventCode>="4726" AND EventCode<="4736") OR EventCode="4737" OR (EventCode>="4743" AND EventCode<="4763") OR EventCode="4764" OR (EventCode>="4782" AND EventCode<="4793")

I don't quite understand the logic behind the search string.

0 Karma

LiquidTension
Path Finder

The following search returned more appropriate results for the user.

index=windows* sourcetype="WinEventLog:Security" (EventCode>="630" AND EventCode<="640") OR EventCode="641" OR (EventCode>="647" AND EventCode<="668") OR (EventCode>="4726" AND EventCode<="4736") OR EventCode="4737" OR (EventCode>="4743" AND EventCode<="4763") OR EventCode="4764" OR (EventCode>="4782" AND EventCode<="4793")

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...