Splunk Search

Matching events by pair

timbCFCA
Path Finder

I'm attempting to map when the count of two event IDs - 4634 and 4624 is different over a time period. These events correlate to logon (4624) and logoff (4634) events.

host=myhost* ( evtid=4634 OR evtid=4624 ) | counttable evtuser, evtid

This works perfectly if the start time does not site between when user logs on and logs off.

I would like to exclude any logoffs which occur prior to the first logon event. I have no idea of the syntax required to do so however.

I was also thinking of a slightly more sophisticated method. I have an additional field - LogonID which uniquely correlates these events in a 1:1 mapping. I'm thinking that it should be possible to exclude the last first logoff event if the first logon event does not have the same LogonID value. My guess is that is more work than is necessary however.

Tags (2)
0 Karma
1 Solution

Drainy
Champion

Well I have just quickly thrown together a transaction on my system to see if it would work. I think it does what you are after..

event_id=4634 OR event_id=4624 | transaction Account_Name ComputerName startswith="EventCode=4634" endswith="EventCode=4624"  keepevicted=true | search  closed_txn=0 | stats count

Obviously you could modify this to meet your exact needs but this will transaction events based on them starting with a logon and ending with a logoff. I choose to keep the events that don't fit in the transaction and then only display them, I can then count them. You could here count by event id or user name etc. If the logonID is in each event you could also transaction based on that.

View solution in original post

Drainy
Champion

Well I have just quickly thrown together a transaction on my system to see if it would work. I think it does what you are after..

event_id=4634 OR event_id=4624 | transaction Account_Name ComputerName startswith="EventCode=4634" endswith="EventCode=4624"  keepevicted=true | search  closed_txn=0 | stats count

Obviously you could modify this to meet your exact needs but this will transaction events based on them starting with a logon and ending with a logoff. I choose to keep the events that don't fit in the transaction and then only display them, I can then count them. You could here count by event id or user name etc. If the logonID is in each event you could also transaction based on that.

timbCFCA
Path Finder

On first glance that definitely looks like what I need. Many thanks.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...