Hi all, I am trying to feed results of a query into another of a different time and index and I'm facing issues with this. Context: I want to look for any user activity across my servers on d+1 for list of user accounts which shows up as disabled on the active directory (windows event code=4725). From the search query below, I want to parse the list of usernames where count=1 and look for any user activity on d+1 onwards after earliest(_time) is recorded.  index=useractivitylogs [search index=wineventlog EventCode=4725 | eval timestamp=strftime(_time, "%Y-%m-%dT%H:%M"%S") | stats count as count, earliest(timestamp) by username | where count=1] Example: Eventcode 4725 is recorded for these 2 users based on my inner search: Timestamp | User: 5 September 2022 | Anna 10 September 2022 | Betty  Then, I want to feed these results to identify any user activity found on any servers on d+1 after the recorded Timestamp.   Thank you.    ... View more

Hi everyone, I am new to splunk. I am looking at windows event logs for the EventCode=4725 for all usernames within a week's timeframe. What I want is to remove username results if there are more than 1 count for this eventcode including that username, and then list in a table to show the timestamp and username when the eventcode occurred. Example: Usernames with EventCode=4725 recorded within 1 week:   Day 1 10pm : anna Day 1 11pm : betty Day 3 10pm : anna Day 3 1pm :  charlie Day 7 2pm : zach   Final result I want is: Day 1 11pm : betty Day 3 1pm :  charlie Day 7 2pm : zach From the above we have 'anna' removed completely from as her event showed up more than once.    This is my original query: index=wineventlog EventCode=4725 | fields * | eval timestamp=strftime(_time, "%Y-%m-%dT%H:%M"%S") | stats count by username | where username = 1 I then realised the problem with using stats count by,  because I wouldnt be able to show the timestamp for the results result this is in statistics.  I have thought of using dedup to remove duplicate values, but I have not found a way to remove duplicate values including that value itself. Please help. Thank you ... View more