Getting Data In

Why is my timestamp not working in Windows event logs?

HCadmins
Communicator

Here is my search

index=wineventlog Account_Domain=* ("EventCode=4625" OR "EventCode=4740") | stats count count(eval(EventCode=4740)) as LockedCount by user Account_Domain | search count>3 | eval Locked=if(LockedCount>1, "Yes", "No") | table _time user count Account_Domain Locked | rename user as "User" count as "Failed Authentication Attempts" Account_Domain as "Domain"

When I look at the log raw data, there is clearly a time stamp.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

The stats command is only passing the count, LockedCount, user, and Account_Domain fields to downstream commands so there is no _time to display. Try using either eventstats or streamstats.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The stats command is only passing the count, LockedCount, user, and Account_Domain fields to downstream commands so there is no _time to display. Try using either eventstats or streamstats.

---
If this reply helps you, Karma would be appreciated.
0 Karma

HCadmins
Communicator

Okay, that made it work. Why is count in there twice?

streamstats count count(eval...)

(I used this code snipped from another Splunk answer)

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The first counts all events and the second counts only those events where EventCode=4740.

---
If this reply helps you, Karma would be appreciated.
0 Karma

woodcock
Esteemed Legend

What is your inputs.conf for this?

Are your indexers using NTP? Do you have the TZ settings correct for this input?

0 Karma

HCadmins
Communicator

My time zone settings are correct, as other inputs are correctly recording time.

If I remove most of the search string like this

index=wineventlog Account_Domain=* | table _time

The time shows up perfectly.

0 Karma

HCadmins
Communicator

When I add in the | stats part is when it seems to break

index=wineventlog Account_Domain=* ("EventCode=4625" OR "EventCode=4740") | stats count count(eval(EventCode=4740)) as LockedCount by user Account_Domain | table _time

Shows no results

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...