I am working on a query to report on events generated within 2 minutes of the first event for the same host.
In the following example, I need a query to look for any occurrence of EventType 4697 within two minutes of EventType 4624 for the same ComputerName
ComputerName=x (This is a unique field)
EventType=4624
EventType=4697
Thanks.
@Splunk77 - Have you tried the transaction command like below:
index=<your_index> EventType=4624 OR EventType=4697
| transaction ComputerName startswith="EventType=4624" endswith="EventType=4697" maxspan=2m
| search EventType=4697
I hope this helps!!!
@Splunk77 - Have you tried the transaction command like below:
index=<your_index> EventType=4624 OR EventType=4697
| transaction ComputerName startswith="EventType=4624" endswith="EventType=4697" maxspan=2m
| search EventType=4697
I hope this helps!!!
Running this query and not quite getting the desired results. I have test events generated within a 2 minute window. Expanded maxspan to 5 minutes to capture a larger window.