The event codes are logon event codes, so they are recording logon events. There are types of logons for the various ways a user can 'logon' to a machine (interactive, network, service, etc... 9 total). You may be interested in only a few of those. Finding users who are currently logged on is a tricky problem in Windows. See this answer for more details: http://answers.splunk.com/answers/43122/determine-users-on-the-same-server-within-a-time-window I don't really like the solution they came up with, so I think you might want to create a new question for that. ... View more