×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
urasplunkronbur
New Member
Member since: ‎02-08-2019
‎06-05-2020
Community Statistics
Posts 2
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎02-08-2019
Activity Feed
View All

Re: How do I filter out events from two separate e...

by in Splunk Search
‎02-08-2019 11:10 AM
‎02-08-2019 11:10 AM
Thank you for the response! The results look great, I'm new to Splunk and trying to learn the ropes, so help is much appreciated. Unfortunately, we are having to rebuild the heavy forwarder due to the fact that many events passed from our windows logs are being dropped. This results in not completely reliable data, so although logically your solution should work, we still sometimes have logoff events that do not have a related logon event. Is there a way, once the distinct count and where clause have executed, to filter out the remaining 4634 events? Thanks. ... View more

How do I filter out events from two separate event...

by in Splunk Search
‎02-08-2019 09:02 AM
‎02-08-2019 09:02 AM
I'm trying to determine which Windows workstations a user is currently logged in to by: Examining logs from our Domain Controllers with Event Codes 4624 (An account was successfully logged on) and 4634 (An account was logged off) filtering them against that user's ID looking for similar Logon_ID fields from both types of events and then deleting those values, as well as, the remaining 4634 events. This technically should give me a report showing only logons by this user with no correlated logoff, but I'm unsure how to create this query. Any help would be appreciated, and if there's a better method for solving this problem, I'm open to anything. Thanks. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM