Quantcast
Channel: Questions in topic: "universal-forwarder"
Viewing all articles
Browse latest Browse all 1551

How to filter out a Windows Event Code if the event from a user repeats over a period of time?

$
0
0
I want to capture Windows Event Logs EventCode 4673 when it happens once for each user over a period of one hour. If a single user generates this Event Code 100 times in one hour I would like to record it only once in Splunk. If this is not doable, can I remove the payload `suppress_text = 1` for this event only and not for all Windows Security Events?

Viewing all articles
Browse latest Browse all 1551

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>