I am running Splunk Enterprise and am trying to create a dashboard panel "Events" search string that pulls multiple Windows Event Log Codes. I am using variations of the code below: index=windows* sourcetype="WinEventLog:Security" (EventCode>="630" AND EventCode<="640") OR EventCode="641" OR (EventCode>="647" AND EventCode<="668") OR (EventCode>="4726" AND EventCode<="4736") OR EventCode="4737" OR (EventCode>="4743" AND EventCode<="4763") OR EventCode="4764" OR (EventCode>="4782" AND EventCode<="4793") I also tried this search to no avail: sourcetype=wineventlog source="WinEventLog:Security" host="xxxx*" EventCode=4625,4624 When I used the second code without the (,4624) it will populate events with 4625 but I have not figured out how to make it pull more than one Event Code properly. It doesn't populate any errors or text failures. It simply presents "no results found. Try expanding the time range" which I went from 15 mins up to YTD. Does Anyone have a Windows Event Search command bank they could share or tell me what to read/explain how to correct my line of code? Thanks! P.S. the (host=XXXX*) is used as a place holder for my organizations host name ... View more

I am in Splunk Enterprise trying to create a Dashboard in the source code. When I input the below code it says on the UI "Unable to create search" in regards to the User: All section Is this a user role restriction preventing me from searching all users or something else? It does not have any errors in the edit source page. Below Code: <form theme="dark"> <label>Splunk Search Activity</label> <fieldset submitButton="true" autoRun="false"> <input type="time" token="time1"> <label></label> <default> <earliest>-24h@h</earliest> <latest>now</latest> </default> </input> <input type="radio" token="exclude1" searchWhenChanged="true"> <label>Splunk System User</label> <choice value="user!=splunk-system-user">exclude</choice> <choice value="*">include</choice> <default>user!=splunk-system-user</default> <initialValue>user!=splunk-system-user</initialValue> </input> <input type="multiselect" token="user1"> <label>User:</label> <fieldForLabel>user1</fieldForLabel> <fieldForValue>user</fieldForValue> <search> <query>index=_audit action=search search!="'typeahead*" $exclude1$ | stats count by user</query> <earliest>$time1.earliest$</earliest> <latest>$time1.latest$</latest> </search> <choice value="*">all</choice> <default>*</default> <initialValue>*</initialValue> <delimiter> </delimiter> </input> <input type="text" token="filter1"> <label>Search Filter:</label> <default>*</default> <initialValue>*</initialValue> <prefix>"*</prefix> <suffix>*"</suffix> </input> </fieldset> <row> <panel> <table> <search> <query>index=_audit action=search search!="'typeahead*" user="$user1$" search=$filter1$ $exclude1$ | stats count by _time user search total_run_time search_id app event_count | sort -_time</query> <earliest>$time1.earliest$</earliest> <latest>$time1.latest$</latest> <sampleRatio>1</sampleRatio> </search> <option name="count">20</option> <option name="dataOverlayMode">none</option> <option name="drilldown">none</option> <option name="percentagesRow">false</option> <option name="refresh.display">progressbar</option> <option name="rowNumbers">false</option> <option name="totalsRow">false</option> <option name="wrap">true</option> </table> </panel> </row> </form> ... View more

Any advice on how to fix this command? I pulled it from GoSplunk "Show all successful Splunk configurations by user." This is on Splunk Enterprise. Below is my entered command and I am getting the error: Comparator '=' has an invalid term on the left hand side: host=object index=_audit action=edit* info=granted operation!=list host= object=* | transaction action user operation host maxspan=30s | stats values(action) as action values(object) as modified_object by _time,operation,user,host | rename user as modified_by | table _time action modified_object modified_by   ... View more