https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-disabled-usernames-along-with-the-status-of/m-p/436992#M174116 <P>Hello @deepak007, do you have a search for finding the status of an adm-username?<BR /> How are usernames and adm-usernames connected? Is it just the prefix "adm-" before the username?</P> Fri, 14 Dec 2018 10:10:48 GMT whrg 2018-12-14T10:10:48Z https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-disabled-usernames-along-with-the-status-of/m-p/436991#M174115 <P>I have 2 types of account for the same user's like<BR /> 1. username<BR /> 2. adm-username</P> <P>As a requirement, I need to find the disabled usernames along with the status of their respective adm-usernames</P> <P>I have the query to find the disabled usernames, but I need to know the status of their adm-username account status.</P> Fri, 14 Dec 2018 09:13:56 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-disabled-usernames-along-with-the-status-of/m-p/436991#M174115 deepak007 2018-12-14T09:13:56Z https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-disabled-usernames-along-with-the-status-of/m-p/436992#M174116 <P>Hello @deepak007, do you have a search for finding the status of an adm-username?<BR /> How are usernames and adm-usernames connected? Is it just the prefix "adm-" before the username?</P> Fri, 14 Dec 2018 10:10:48 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-disabled-usernames-along-with-the-status-of/m-p/436992#M174116 whrg 2018-12-14T10:10:48Z https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-disabled-usernames-along-with-the-status-of/m-p/436993#M174117 <P>yes we have 2 types of user names in our environment</P> <OL> <LI>username</LI> <LI>adm-username</LI> </OL> <P>same user holds both the accounts, but both the accounts are different</P> Mon, 17 Dec 2018 02:13:17 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-disabled-usernames-along-with-the-status-of/m-p/436993#M174117 deepak007 2018-12-17T02:13:17Z https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-disabled-usernames-along-with-the-status-of/m-p/436994#M174118 <P>I presume you have two searches:<BR /> - one search for finding all disabled users<BR /> - one search for finding all adm-users and their respective status</P> <P>I suggest you use the <A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join" target="_blank">join command</A>:</P> <PRE><CODE>index=... your search for all disabled users | dedup username | table username | eval adm_username="adm-".username | join type=left adm_username [search index=... your search for all adm-users | rename username as adm_username status as adm_status | table adm_username,adm_status] </CODE></PRE> <P>This should get you a table with the columns: username, adm_username, adm_status</P> Tue, 29 Sep 2020 22:24:45 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-disabled-usernames-along-with-the-status-of/m-p/436994#M174118 whrg 2020-09-29T22:24:45Z https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-disabled-usernames-along-with-the-status-of/m-p/436995#M174119 <P>not getting what I need to, its just changing the name by prefixing the ADM- in front of username.</P> <P>maybe I was not clear with the query, I need to search the existing ADM accounts present or not for the users that are disabled, as we dont have adm account for all the user's</P> <P>running this query not solving the issue</P> <P>sourcetype="WinEventLog:Security" EventCode=4725 user!="<EM>$" | dedup user | table user<BR /> | eval adm_username="adm-".user<BR /> | join type=left adm_username [search sourcetype="WinEventLog:Security" EventCode=4725 user!="</EM>$" OR user="adm-*" | rename user as adm_username status as adm_status | table adm_username,adm_status]</P> Tue, 29 Sep 2020 22:26:36 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-disabled-usernames-along-with-the-status-of/m-p/436995#M174119 deepak007 2020-09-29T22:26:36Z https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-disabled-usernames-along-with-the-status-of/m-p/436996#M174120 <P>So do you just want to list all ADM accounts which are disabled? Or do you want to list all ADM accounts with their respective status (enabled/disabled)? Perhaps you could provide an example as to what the expected results should look like.</P> Thu, 20 Dec 2018 09:44:54 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-disabled-usernames-along-with-the-status-of/m-p/436996#M174120 whrg 2018-12-20T09:44:54Z https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-disabled-usernames-along-with-the-status-of/m-p/436997#M174121 <P>Hi Whrg,</P> <P>basically I want the ADM accounts which are left out.<BR /> in our organization there is a process of disabling the user accounts not the adm accounts, i need something that tells me the adm account is left for the respective user account which is disabled.<BR /> so that we can manually disable them</P> <P>note: ADM account is not for all the user's in the organization, its just 40% of the users have ADM account</P> Wed, 02 Jan 2019 04:09:02 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-find-the-disabled-usernames-along-with-the-status-of/m-p/436997#M174121 deepak007 2019-01-02T04:09:02Z