https://community.splunk.com/t5/Getting-Data-In/Filter-account-domain/m-p/198674#M39372 <P>Yes, but I'm guessing about the specifics you're after.</P> <P>If you are talking about Windows 2K8 or Vista EventCode 4740, then you would filter on the Account_Domain field. </P> <P>In this example you would change 'domain1' to one of your domains.</P> <PRE><CODE>index=main EventCode=4740 Account_Domain=domain1 | eval Account_Name=mvindex(Account_Name,1)| table _time Account_Domain Account_Name Caller_Computer_Name </CODE></PRE> <P>If you want to have the results sorted by domain, then use something like this:</P> <PRE><CODE>index=main EventCode=4740 | eval Account_Name=mvindex(Account_Name,1)| table Account_Domain _time Account_Name Caller_Computer_Name </CODE></PRE> <P>If you are talking about older Windows systems, then you would filter on the Caller_Domain field. For example:</P> <PRE><CODE>index=main EventCode=644 | table Caller_Domain _time Target_Account_Name Caller_Machine_Name </CODE></PRE> <P>If you have a mix, then you can combine the two like this:</P> <PRE><CODE>index=main EventCode=4740 | eval Account_Name=mvindex(Account_Name,1)|eval Source=coalesce (Caller_Computer_Name,ComputerName)| table Account_Domain _time Account_Name Source| rename Account_Domain AS Domain Account_Name AS Account |append [search index=main EventCode=644 | table Caller_Domain _time Target_Account_Name Caller_Machine_Name | rename Caller_Domain AS Domain Target_Account_Name AS Account Caller_Machine_Name AS Source] </CODE></PRE> Thu, 09 Jan 2014 20:26:55 GMT lukejadamec 2014-01-09T20:26:55Z https://community.splunk.com/t5/Getting-Data-In/Filter-account-domain/m-p/198673#M39371 <P>I, i need to make a dashboard for accounts locked and i would like to had a filter by account domain.<BR /> Is this possible? Can i make a search by account domain?</P> <P>Thank you </P> Thu, 09 Jan 2014 10:08:15 GMT https://community.splunk.com/t5/Getting-Data-In/Filter-account-domain/m-p/198673#M39371 borgeshe 2014-01-09T10:08:15Z https://community.splunk.com/t5/Getting-Data-In/Filter-account-domain/m-p/198674#M39372 <P>Yes, but I'm guessing about the specifics you're after.</P> <P>If you are talking about Windows 2K8 or Vista EventCode 4740, then you would filter on the Account_Domain field. </P> <P>In this example you would change 'domain1' to one of your domains.</P> <PRE><CODE>index=main EventCode=4740 Account_Domain=domain1 | eval Account_Name=mvindex(Account_Name,1)| table _time Account_Domain Account_Name Caller_Computer_Name </CODE></PRE> <P>If you want to have the results sorted by domain, then use something like this:</P> <PRE><CODE>index=main EventCode=4740 | eval Account_Name=mvindex(Account_Name,1)| table Account_Domain _time Account_Name Caller_Computer_Name </CODE></PRE> <P>If you are talking about older Windows systems, then you would filter on the Caller_Domain field. For example:</P> <PRE><CODE>index=main EventCode=644 | table Caller_Domain _time Target_Account_Name Caller_Machine_Name </CODE></PRE> <P>If you have a mix, then you can combine the two like this:</P> <PRE><CODE>index=main EventCode=4740 | eval Account_Name=mvindex(Account_Name,1)|eval Source=coalesce (Caller_Computer_Name,ComputerName)| table Account_Domain _time Account_Name Source| rename Account_Domain AS Domain Account_Name AS Account |append [search index=main EventCode=644 | table Caller_Domain _time Target_Account_Name Caller_Machine_Name | rename Caller_Domain AS Domain Target_Account_Name AS Account Caller_Machine_Name AS Source] </CODE></PRE> Thu, 09 Jan 2014 20:26:55 GMT https://community.splunk.com/t5/Getting-Data-In/Filter-account-domain/m-p/198674#M39372 lukejadamec 2014-01-09T20:26:55Z https://community.splunk.com/t5/Getting-Data-In/Filter-account-domain/m-p/198675#M39373 <P>Thank you for your most appreciated help <span class="lia-unicode-emoji" title=":winking_face:">😉</span></P> Fri, 10 Jan 2014 10:15:28 GMT https://community.splunk.com/t5/Getting-Data-In/Filter-account-domain/m-p/198675#M39373 borgeshe 2014-01-10T10:15:28Z https://community.splunk.com/t5/Getting-Data-In/Filter-account-domain/m-p/198676#M39374 <P>No problem. Don't forget to accept the answer:)</P> Fri, 10 Jan 2014 14:07:27 GMT https://community.splunk.com/t5/Getting-Data-In/Filter-account-domain/m-p/198676#M39374 lukejadamec 2014-01-10T14:07:27Z