Splunk Active Directory Logs

revanthammineni — Mon, 05 Oct 2020 19:15:12 GMT

Hi Splunkers,

With the Splunk Active Directory logs, Splunk parses the event as though there's no difference between the actor and the target of a critical event like a new account being created. How can i able to give a different name to the targeted account? Is there any way other than Regex?

Attaching a screenshot. TIA

Re: Splunk Active Directory Logs

gcusello — Mon, 05 Oct 2020 19:54:33 GMT

Hi @revanthammineni,

no regex is the only way to extract that kind of data.

Anyway, I had many problems with regexes, but when I learned to use them a new world was open for me, so I recommend that you work hard to learn how to use regexes.

Ciao.

Giuseppe

topic Splunk Active Directory Logs in Monitoring Splunk

Splunk Active Directory Logs

Re: Splunk Active Directory Logs