Please forgive me, I am new to Splunk. I'm trying to create a dashboard that visualizes successful/failures logins. I don't have anyone I work with that's a professional or even knowledgeable/experienced enough to help. So, I started to use ChatGPT to help develop these strings. After I got the base setup from ChatGPT, I tried to fill in the sourcetypes. But now I'm getting this error: Error in 'EvalCommand': The expression is malformed. Please let me know what I need to do to fix this. Ask away please. It'll only help me get better. index=ActiveDirectory OR index=WindowsLogs OR index=WinEventLog ( (sourcetype=WinEventLog (EventCode=4624 OR EventCode=4625)) # Windows logon events OR (sourcetype=ActiveDirectory "Logon" OR "Failed logon") # Active Directory logon events (adjust keywords if needed) ) | eval LogonType=case( EventCode=4624, "Successful Windows Login", EventCode=4625, "Failed Windows Login", searchmatch("Logon"), "Successful AD Login", searchmatch("Failed logon"), "Failed AD Login" ) | eval user=coalesce(Account_Name, user) # Combine Account_Name and user fields | eval src_ip=coalesce(src_ip, host) # Unify source IP or host | stats count by LogonType, user, src_ip | sort - count
... View more
