Splunk Search

How can I make a table for multiple Windows Events ?

itrimble1
Path Finder

How can I make a table for multiple Windows Events ? This search gives me good results for one Event Code, but I have multiple Event IDs. Trying to do some tuning.

index=wineventlog source=WinEventLog:security EventCode=4624
 | fields _raw 
 | eval esize=len(_raw) 
 | stats count as count avg(esize) as avg 
 | eval bytes=count*avg 
 | eval kb=bytes/1024 
 | eval mb=round(kb/1024,2) 
 | stats values(kb) as KB, values(mb) AS MB
Tags (3)
0 Karma

woodcock
Esteemed Legend

Like this:

index=wineventlog source=WinEventLog:security
| fields _raw 
| eval esize=len(_raw) 
| stats count AS count avg(esize) AS avg 
| eval bytes=count*avg 
| eval kb=bytes/1024 
| eval mb=round(kb/1024,2) 
| stats values(kb) AS KB, values(mb) AS MB BY EventCode

Also be aware that convert and has some things to do the bytes->whatever things.

0 Karma

tiagofbmm
Influencer

How about splitting by EventCode:

 index=wineventlog source=WinEventLog:security 
  | fields _raw 
  | eval esize=len(_raw) 
  | stats count as count avg(esize) as avg by EventCode
  | eval bytes=count*avg 
  | eval kb=bytes/1024 
  | eval mb=round(kb/1024,2) 
  | stats values(kb) as KB, values(mb) AS MB by EventCode
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...