Splunk Search

How to pull RDP Connections in my environment?

Cyberguru
Engager

Query doesnt bring up anything.

Try to pull RDP connections in my environment: 

 

 

event_simpleName=UserLogon LogonType_decimal=10

| stats values(UserName) dc(UserName) AS "User Count" count(UserName) AS "Logon Count" by aid, ComputerName

| sort - "Logon Count"

 

Labels (4)
Tags (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

First, illustrate your raw data.  Are "aid" and "ComputerName" available at search time, AND are they present in (at least some of) the same events?  For example, what does this give you?

event_simpleName=UserLogon LogonType_decimal=10
| table aid, ComputerName

Also, the search appears to be about user name.  How does this relate to "pulling RDP connections" in the title?

View solution in original post

0 Karma

Cyberguru
Engager

Thanks for the answer

0 Karma

yuanliu
SplunkTrust
SplunkTrust

First, illustrate your raw data.  Are "aid" and "ComputerName" available at search time, AND are they present in (at least some of) the same events?  For example, what does this give you?

event_simpleName=UserLogon LogonType_decimal=10
| table aid, ComputerName

Also, the search appears to be about user name.  How does this relate to "pulling RDP connections" in the title?

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...