Windows Logon_Type

[geekf]

When I am running this search I am not getting the results for EventType=4769:

index=main  (EventCode=4634 OR EventCode=4624 OR EventCode=4769) Logon_Type!=3

If I run the search index=main (EventCode=4769) OR Logon_Type!=3 I get the results for 4769.

What can I do with the first search to include the results for 4769?

Thanks in advance!

[gcusello]

Hi @geekf,

maybe you haven't events with EventCode=4769 AND Logon_Type=3.

To be sure, try this:

 index=main EventCode=4769 Logon_Type=3

have you results?

Ciao.

Giuseppe 

[geekf · Accepted solution]

Hi @gcusello 

Thank you for your prompt response. I am getting results with this search:

index=main (EventCode=4769) OR Logon_Type!=3

I managed to solve it by using NOT instead of !=.

index=main  (EventCode=4634 OR EventCode=4624 OR EventCode=4769) Logon_Type!=3

The above search is not giving me the results; however, if I use this search, it works fine:

index=main  (EventCode=4634 OR EventCode=4624 OR EventCode=4769) NOT Logon_Type=3

Here is what was causing this issue:

If you search with the  != expression, every event that has a value in the field, where that value does not match the value you specify, is returned. Events that do not have a value in the field are not included in the results.

If you search with the NOT operator, every event is returned except the events that contain the value you specify. This includes events that do not have a value in the field.

https://docs.splunk.com/Documentation/Splunk/8.1.0/Search/NOTexpressions

Thank you!

[gcusello]

HI @geekf,

good for you!

Please accept the answer for the other people of Community.

Ciao and happy splunking.

Giuseppe

P.S.: Karma Points are appreciated 😉