Weekend User Activity WinEventLog:Security SplunkNinja 7 Comments 1 3 Run the following (modify user field as needed) to show weekend activity: sourcetype="WinEventLog:Security" (date_wday=saturday OR date_wday=sunday) | stats count by Account_Name, date_wday 1 sourcetype="WinEventLog:Security" (date_wday=saturday OR date_wday=sunday) | stats count by Account_Name, date_wday Continue Reading →
