Windows Events Summary Click on the event to check it on www.eventid.net

Select time range -24h@h now Event types Error,Warning Error Warning Information ( ) Type=" " OR Type Type Security Events Denial,Audit Failure Audit Failure Audit Success ( ) " " OR Audit Type Audit Type Audit Failure Computer All * ( ) host=" " OR `event_sources` | stats count by host $interval.earliest$ $interval.latest$ host host Keyword: * Excluded event sources none ( ) SourceName!=" " AND None `event_sources` $Type$ AND $Computer$ AND $keyword$ | stats count by SourceName $interval.earliest$ $interval.latest$ SourceName SourceName

`event_sources` Type="Error" AND $Computer$ AND $keyword$ | stats count $interval.earliest$ $interval.latest$ 1 value block all 0 ["0xd93f3c","0xd93f3c"] [0] progressbar 1 1 0 1 medium standard absolute after 1 1 `event_sources` Type="Warning" AND $Computer$ AND $keyword$ | stats count $interval.earliest$ $interval.latest$ 1 value block all 0 ["0xf7bc38","0xf7bc38"] [0] progressbar 1 1 0 1 medium standard absolute after 1 1 `event_sources` Type="Information" AND NOT ("Audit Success" OR "Audit Failure") AND $Computer$ AND $keyword$ | stats count $interval.earliest$ $interval.latest$ 1 value block all 0 ["0x65a637","0x65a637"] [0] progressbar 1 1 0 1 medium standard absolute after 1 1 search?q=`event_sources` Type="Information" | stats count&earliest=$interval.earliest$&latest=$interval.latest$ `event_sources` "Audit Failure" AND $Computer$ AND $keyword$ | stats count $interval.earliest$ $interval.latest$ 1 block all ["0xf58f39","0xf58f39"] [0] progressbar 1 /app/eventid/audit_events `event_sources` Keywords="Audit Success" AND $Computer$ AND $keyword$ | stats count $interval.earliest$ $interval.latest$ 1 block none ["0x6db7c6","0x6db7c6"] [0] progressbar 1 `event_sources` Failure_Reason=* ("Audit Failure") AND $Computer$ AND $keyword$ | eval user=mvindex(Account_Name,1) | stats count -24h@h now block all ["0xcc0000","0xcc0000"] [0] progressbar 1 /app/eventid/audit_events `event_sources` Failure_Reason=* * ("Audit Failure") AND $Computer$ AND $keyword$ | stats count by user | where count > 2 $interval.earliest$ $interval.latest$ 1 ellipsisNone 0 visible visible visible linear linear 0 inherit pie 50 10 area gaps none 0.01 default shiny all 0 0 ellipsisMiddle right progressbar `event_sources` AND $Computer$ AND $keyword$ AND ($Audit_Type$ OR $Type$) | eval SourceName = coalesce(SourceName,source) | fillnull | search $sourcetype_token$ | stats count by host $interval.earliest$ $interval.latest$ pie none progressbar /app/eventid/eventid?form.Computer=$row.host$ `event_sources` AND $Computer$ AND $keyword$ AND ($Audit_Type$ OR $Type$) | timechart count $interval.earliest$ $interval.latest$ 1 Time Events 1 area gaps "Audit Failure" default all 0 none progressbar `event_sources` AND $Computer$ AND $keyword$ AND ($Audit_Type$ OR $Type$) | eval SourceName = coalesce(SourceName,Provider) | eval Type = coalesce(Type,Keyword) | fillnull value="-" | stats earliest(_time) as First latest(_time) as Last count by host, EventCode, SourceName, Type | sort -count host, EventCode, SourceName, Type | rename EventCode as "EventId" | fieldformat First=strftime(First,"%x %X") | fieldformat Last=strftime(Last,"%x %X") $interval.earliest$ $interval.latest$ 10nonecellprogressbarfalsetrue https://www.eventid.net/display.asp?eventid=$row.EventId$&source=$row.SourceName$&app=SplunkEvId `event_sources` AND $Computer$ AND $keyword$ AND ($Audit_Type$ OR $Type$) | eval SourceName = coalesce(SourceName,Provider) | eval Type = coalesce(Type,Keyword) | fillnull | table _time, host, EventCode, SourceName, Type, Message | rename EventCode as "EventId" $interval.earliest$ $interval.latest$ 10nonecellprogressbarfalsetrue