I'm trying to determine which Windows workstations a user is currently logged in to by:
This technically should give me a report showing only logons by this user with no correlated logoff, but I'm unsure how to create this query.
Any help would be appreciated, and if there's a better method for solving this problem, I'm open to anything.
Thanks.
Like this:
index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo AND (EventCode="4624" OR EventCode="4634")
| streamstats count(eval(EventCode="4634")) AS sessoinID BY Logon_ID
| stats dc(EventCode) AS numEventCodes BY Logon_ID
| where numEventCodes<2
Thank you for the response! The results look great, I'm new to Splunk and trying to learn the ropes, so help is much appreciated.
Unfortunately, we are having to rebuild the heavy forwarder due to the fact that many events passed from our windows logs are being dropped. This results in not completely reliable data, so although logically your solution should work, we still sometimes have logoff events that do not have a related logon event. Is there a way, once the distinct count and where clause have executed, to filter out the remaining 4634 events?
Thanks.
Sure, just change the last 2 lines to this:
| stats dc(EventCode) AS numEventCodes values(EventCode) AS EventCodes BY Logon_ID
| where numEventCodes<2 AND EventCodes="4363"