topic Splunk Query For Admin Who Unlocked Account in Splunk Search

Splunk Query For Admin Who Unlocked Account

k45bryant — Tue, 14 May 2019 15:55:50 GMT

Hello All,

I created a query that looks for event 4767 (A user account was unlocked) and it returns the date/time of the event, the Administrator (Account_Name) who unlocked the account and the user who's account was unlocked. The problem is that it also lists the user's account under the "who unlocked the user" column. I think the query is pulling that information from the Target Account --> Account Name field. How do I exclude that from my results?

Here is my query:

index="wineventlog" EventCode=4767 user=$users$ | stats count by _time, Account_Name, user | fields - count | sort - _time

Re: Splunk Query For Admin Who Unlocked Account

Vijeta — Tue, 14 May 2019 17:02:01 GMT

can you share some sample events?

Re: Splunk Query For Admin Who Unlocked Account

k45bryant — Tue, 14 May 2019 17:05:35 GMT

Are you asking for the results after I run my query? I am not sure what you mean by sample events. Can you clarify your question?

Re: Splunk Query For Admin Who Unlocked Account

Vijeta — Tue, 14 May 2019 17:06:30 GMT

the data on which you are performing search

Re: Splunk Query For Admin Who Unlocked Account

k45bryant — Wed, 25 Jan 2023 18:31:53 GMT

Sure. Here you go:

5/13/19
3:50:35.000 PM

05/13/2019 03:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4767
EventType=0
Type=Information
ComputerName=x.com
TaskCategory=User Account Management
OpCode=Info
RecordNumber=xxx
Keywords=Audit Success
Message=A user account was unlocked.

Subject:
Security ID: xxx
Account Name: xx
Account Domain: LANS
Logon ID: xx

Target Account:
Security ID: xx
Account Name:xx
Account Domain: LANS
Collapse
host = xx source = WinEventLog:Security sourcetype = WinEventLog:Security src_user = xx user = xx

Re: Splunk Query For Admin Who Unlocked Account

Vijeta — Tue, 14 May 2019 18:25:59 GMT

you will have to apply some regex to get the Account Name fields for user(based on target account name) and Admin (based on Subject Account Name)

Re: Splunk Query For Admin Who Unlocked Account

k45bryant — Tue, 14 May 2019 18:46:04 GMT

I am a newbie to splunk and have no idea how to apply regex to my query. Can you help me?

Re: Splunk Query For Admin Who Unlocked Account

aromanauskas — Wed, 30 Sep 2020 00:30:41 GMT

Your answer is in the already extracted fields.

index="wineventlog" EventCode=4767 user=$users$ | stats count by _time, src_user, user | fields - count | sort - _time

Re: Splunk Query For Admin Who Unlocked Account

k45bryant — Tue, 14 May 2019 19:58:12 GMT

That worked! Thank you soooo much. You ROCK!