I'm trying to audit an environment based on Window's RDP event codes 21, 22, and 25. I'm able to display the number of RDP events for systems that have them, but for the ones that don't, I can't get them to display a value of 0 in the results.
I tried using "fillnull" but couldn't find a solution.
Search:
source="wineventlog:microsoft-windows-terminalservices-localsessionmanager/operational" (EventCode=21 OR EventCode=22 OR EventCode=25) | stats count by host
... View more