Hi all,
i'm trying to record all RD session on my server, i've write this query:
index=server source="WinEventLog:Microsoft-Windows-TerminalServices-LocalSessionManager/Operational" EventCode=24 OR EventCode=21 OR EventCode=25| eval username = mvindex(User,1) | eval EventType = case(EventCode == 21, "SessionStart", EventCode == 25, "SessionStart", EventCode == 24, "SessionEnd") |transaction Session_ID startswith=EventType=SessionStart endswith=EventType=SessionEnd | eval duration = (duration* 1000) |table "_time" "host" "username" "EventType" duration
It works but I need to separate every session by host, in other words transaction must be evaluated only if the host value of the start event is the same of the end event.
thanks
↧