https://community.splunk.com/t5/Splunk-Enterprise-Security/Unknown-users-reported-in-Authetication-datamodel/m-p/744350#M12482 <P>We have an alert showing users that are authenticating after working hours for security reasons, I'm sure y'all familiar with, but at the same time, we know who leaves their workstations on during the night.</P><P>However, we have recently received alerts with "unknown" users reported in the alert. But after checking the host's event viewer (Security Log) and comparing with the timestamps in the alert, the event logs shows the users.</P><P>Any idea how we can edit our search string, or what may have caused the string to return the unknown value?</P> Thu, 17 Apr 2025 00:07:13 GMT EFonua 2025-04-17T00:07:13Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Unknown-users-reported-in-Authetication-datamodel/m-p/744350#M12482 <P>We have an alert showing users that are authenticating after working hours for security reasons, I'm sure y'all familiar with, but at the same time, we know who leaves their workstations on during the night.</P><P>However, we have recently received alerts with "unknown" users reported in the alert. But after checking the host's event viewer (Security Log) and comparing with the timestamps in the alert, the event logs shows the users.</P><P>Any idea how we can edit our search string, or what may have caused the string to return the unknown value?</P> Thu, 17 Apr 2025 00:07:13 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Unknown-users-reported-in-Authetication-datamodel/m-p/744350#M12482 EFonua 2025-04-17T00:07:13Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Unknown-users-reported-in-Authetication-datamodel/m-p/744402#M12483 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/309377">@EFonua</a>&nbsp;</P><P>It seems that something must have changed in either the field extractions for your users, or the source data.&nbsp;</P><P>Have you updated any apps recently or made any field extractions changes?</P><P>Without the actual search you are running it is hard for us to determine the issue here, but I would start out by running the search manually to see what user values you get, then work back from there to determine why the correct value isnt appearing.</P><P><span class="lia-unicode-emoji" title=":glowing_star:">🌟</span><SPAN>&nbsp;</SPAN><STRONG>Did this answer help you?</STRONG><SPAN>&nbsp;</SPAN>If so, please consider:</P><UL><LI>Adding karma to show it was useful</LI><LI>Marking it as the solution if it resolved your issue</LI><LI>Commenting if you need any clarification</LI></UL><P>Your feedback encourages the volunteers in this community to continue contributing</P> Thu, 17 Apr 2025 08:58:28 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Unknown-users-reported-in-Authetication-datamodel/m-p/744402#M12483 livehybrid 2025-04-17T08:58:28Z