Searching ranges of event codes from windows event logs

[LiquidTension]

A user within my organization was attempting to search for various windows events that indicated that somebody modified a user's acccess on a machine or domain controller. Originally the search being used was the following:

(EventCode > 630 AND EventCode < 640) OR EventCode = 641 OR (EventCode > 647 AND EventCode < 668) OR (EventCode > 4726 AND EventCode < 4736) OR EventCode = 4737 OR (EventCode > 4743 AND EventCode < 4763) OR EventCode = 4764 OR (EventCode > 4782 AND EventCode < 4793)

This was not returning the range of event codes properly.

I modified the search accordingly and came up with this:

index=windows* sourcetype="WinEventLog:Security" (EventCode>="630" AND EventCode<="640") OR EventCode="641" OR (EventCode>="647" AND EventCode<="668") OR (EventCode>="4726" AND EventCode<="4736") OR EventCode="4737" OR (EventCode>="4743" AND EventCode<="4763") OR EventCode="4764" OR (EventCode>="4782" AND EventCode<="4793")

Thought I would share for people.

-Regards

[splunknewbie81]

Sorry to hijack this thread. 

Can someone please explain to me this string?

(EventCode>="630" AND EventCode<="640") OR EventCode="641" OR (EventCode>="647" AND EventCode<="668") OR (EventCode>="4726" AND EventCode<="4736") OR EventCode="4737" OR (EventCode>="4743" AND EventCode<="4763") OR EventCode="4764" OR (EventCode>="4782" AND EventCode<="4793")

I don't quite understand the logic behind the search string.

[LiquidTension · Accepted solution]

The following search returned more appropriate results for the user.

index=windows* sourcetype="WinEventLog:Security" (EventCode>="630" AND EventCode<="640") OR EventCode="641" OR (EventCode>="647" AND EventCode<="668") OR (EventCode>="4726" AND EventCode<="4736") OR EventCode="4737" OR (EventCode>="4743" AND EventCode<="4763") OR EventCode="4764" OR (EventCode>="4782" AND EventCode<="4793")