1. Tony Vincent

      Security Owl–From the “Search and Reporting” app, click Dashboards, then the big green button to create a new dashboard. Name the dashboard and click create. Now you are in the “edit dashboard” screen, click SOURCE, delete EVERYTHING there, and replace it with the above dashboard XML. -tv

      1. Splunk Senpai

        The problem is that the User field input is not configured correctly. It does nothing actually. I’m working on fixing the input, test it and post the code here

        1. thall

          Afternoon, the field input at the top of the dashboard is designed to be a generic filter and not tied to any specific field. If you want you can either enter a value or field=value and it should filter the dashboard accordingly. I pulled the dashboard in my home environment and everything works including the drilldown and the field input. Unless you a speaking of a different part of the dashboard.


  1. DFlow

    Heads up… Login type 10 is remote interactive (i.e. RDP, Terminal Services, Remote Assistance), however login type 2 is an interactive login (i.e. by typing user name and password on Windows logon prompt).

  2. SHovanec

    When I attempt to drill down on a user, the bottom panel returns with the error:

    ” Error in ‘from’ command: Invalid dataset specifier ‘hour’, expected dataset-type:dataset-name. Verify your search string.”

    I’ve copied & pasted your text from above, only changing my index name in the query. Any suggestions would be appreciated, I’m a Splunk noob so I’m not sure

    1. thall

      Thanks for bringing this to my attention.

      Why you are getting the error is because the “join” command is looking for search that is not there.

      There seems to be an issue with the GoSplunk site where part of the 2nd query that is wrapped in square brackets [ ] is not showing up in the post. However, when editing the post the whole query is there. I tried many ways to re-format the post, but was unsuccessful.

      Here is the complete 2nd query, just remember to update the 2 spots with index=(your_index):

      index=wineventlog $field1$ EventCode=4624 Logon_Type=2 OR Logon_Type=10 earliest=-30d@d latest=-24h user=$user$ | fields _time | timechart count span=1h | eval hour = strftime(_time,”%H”) | stats sum(count) as 30day by hour | join type=outer hour [search index=wineventlog $field1$ EventCode=4624 Logon_Type=2 OR Logon_Type=10 earliest=-24h user=$user$ | fields _time | timechart count span=1h | eval hour = strftime(_time,"%H") | stats sum(count) as 24h by hour]


Leave A Comment?