2008-02-04T17:21:36+0000 10.208.240.110 [syslog.info] MSWinEventLog	1	Security	10072140	Mon Feb 04 09:29:02 2008	673	Security	SYSTEM	User	Success Audit	CHI2K3DS01	Account Logon		Service Ticket Request:     User Name: THOMASA@CHI.WARRANTY.LOCAL     User Domain: CHI.WARRANTY.LOCAL     Service Name: USCHINTFS816$     Service ID: %{S-1-5-21-531451982-1846984212-2848423757-2531}     Ticket Options: 0x40800000     Ticket Encryption Type: 0x17     Client Address: 10.208.244.56     Failure Code: -     Logon GUID: {390999b3-2f06-c42c-16b1-53c6b4c7ac2c}     Transited Services: -    	10072139

HOST=Security      

    * Report on all hosts
    * Search for this host
    * Tag host

| 
SOURCE=/var/log/buffers/windows      

    * Report on all sources
    * Search for this source

| 
SOURCETYPE=windows_snare_syslog      

    * Report on all sourcetypes
    * Search for this sourcetype
    * Edit sourcetype alias

02/04/08 17:21:36
      

    * Search SplunkBase
    * Show source

2008-02-04T17:21:36+0000 70.42.85.25 [syslog.info] MSWinEventLog	1	Security	564952	Mon Feb 04 11:21:25 2008	528	Security	HerculesServer	User	Success Audit	USCHISECRA03	Logon/Logoff		Successful Logon:     User Name: HerculesServer     Domain: USCHISECRA03     Logon ID: (0x0,0xEEF70C6)     Logon Type: 2     Logon Process: Advapi       Authentication Package: MICROSOFT_AUTHENTICATION_PACKAGE_V1_0     Workstation Name: USCHISECRA03     Logon GUID: -     Caller User Name: USCHISECRA03$     Caller Domain: WORKGROUP     Caller Logon ID: (0x0,0x3E7)     Caller Process ID: 2756     Transited Services: -     Source Network Address: -     Source Port: -    	564951