Hi,
We have logs from all of our Windows and Linux Servers and Workstations and I would like to create a table daily to help analyse historical logs.
What I would like to get from the Windows Logs (Currently System, Security and Application Logs) is the currently logged-on user, time of logon and logoff, and IP address and Machine Name.
These are all in various Windows logs, but before I try to put it all together I was wondering if anyone here has already done this?
Thanks!
Ken
Have you tried the Splunk App for Active Directory? This contains the information you are looking for and normalizes both the NT5 and NT6 logs. Also, it creates a temporal lookup of IP address to machine name for you.
You can get it here: http://splunk-base.splunk.com/apps/51338/splunk-app-for-active-directory