Comments

1. Libby Baugher August 1, 2020 at 7:44 pm

   Is it possible to add a specific user account to this search? So instead of searching all accounts, you could search one or two accounts?

   Reply
   1. Splunkysplunk August 2, 2020 at 10:26 pm

      yes you can specify by: Account_Name=”user_name_here”

      Reply
      1. Libby Baugher August 12, 2020 at 7:18 am

         Thank you Splunkysplunk! I’m wondering if this website also has a section for requests? Do you happen to know about this? I’m trying to find a query that would search for steganography applications across our enterprise. Any ideas?

         Reply
2. Libby Baugher August 11, 2020 at 9:49 am

   Thank you! I’m new to Splunk so can you tell me where I would place that syntax in the search string?

   Reply
   1. SplunkNinja August 11, 2020 at 10:59 am

      sourcetype=”WinEventLog:Security” (date_wday=saturday OR date_wday=sunday) Account_Name=”user_name_here” | stats count by Account_Name, date_wday

      Reply
      1. Libby Baugher August 12, 2020 at 7:17 am

         Thanks Splunk Ninja! I’m wondering if this website also has a section for requests? Do you happen to know about this? I’m trying to find a query that would search for steganography applications across our enterprise. Any ideas?

         Reply
         1. SplunkNinja August 12, 2020 at 9:48 am

            Feel free to join our discord for a live chat & discussion as well as requests! https://discord.gg/K8CFbB7

            Reply