topic Re: How to exclude computer account name from results in Splunk Search

How to exclude computer account name from results

arkonner — Tue, 29 Mar 2016 08:29:48 GMT

I am running a very simple search to determine accounts locked out:

server01 OR server02 OR server03 OR server04 EventCode=4740 Security_ID="*" Account_Name="*"   | Table Account_Name  _time

In the results as Account_Name I would like to exclude the computer account name (Server01$.....) considering that the user account name is related to the computer account name.

Re: How to exclude computer account name from results

javiergn — Tue, 29 Mar 2016 14:28:32 GMT

You can use the where command for that:

server01 OR server02 OR server03 OR server04 EventCode=4740 Security_ID="" Account_Name="" 
| where NOT Account_Name=Computer_Name
| Table Account_Name _time

Or even an eval:

server01 OR server02 OR server03 OR server04 EventCode=4740 Security_ID="" Account_Name="" 
| eval Same = if(match(Account_Name,Computer_Name),1,0)
| search Same = 0
| Table Account_Name _time

Re: How to exclude computer account name from results

peauxdunk — Tue, 29 Mar 2016 15:01:56 GMT

try this? a mix of rex and fields trickery

server01 OR server02 OR server03 OR server04 EventCode=4740 Security_ID="" Account_Name="" | Table Account_Name _time | rex field=Account_Name "(?<user>\$\w+)" | fields - Account_Name

This output should give you a new field called User and Omit the Server##

Re: How to exclude computer account name from results

arkonner — Wed, 30 Mar 2016 14:09:56 GMT

running both search as result I obtained

Domain controller computer account
user name

domainctrl1$
j.doe

domainctrl2$
s.brown

domainctrl1$
j.smith

I am looking just for the list of the user name

j.doe
s.brown
j.smith

Re: How to exclude computer account name from results

javiergn — Fri, 01 Apr 2016 09:31:07 GMT

Hi, I'm not sure what you mean but if you just need the list of usernames then simply pipe the last line in your query to fields or table followed by the field name you want to display, you can even remove duplicates with dedup. For instance:

your search here
| dedup UserName
| table UserName

If that's not what you are looking for then it might be easier if you paste your query here.

Re: How to exclude computer account name from results

Stevelim — Fri, 01 Apr 2016 13:31:26 GMT

How about?

server01 OR server02 OR server03 OR server04 EventCode=4740 Security_ID="*" Account_Name!="*Server01$*"| stats values(Account_Name) as List | mvexpand List

Re: How to exclude computer account name from results

tecooper — Mon, 17 Dec 2018 20:29:31 GMT

@Stevelim I've been looking for this answer for 2 days now. You saved me!!! Thank you!

Re: How to exclude computer account name from results

Stevelim — Fri, 21 Dec 2018 00:31:08 GMT

Great to hear!

Re: How to exclude computer account name from results

woodcock — Fri, 21 Dec 2018 00:38:23 GMT

Like this:

index=YouShouldAlwaysSpecifyAnIndex sourcetype=AndSourcetypeToo (server01 OR server02 OR server03 OR server04) EventCode=4740 Security_ID="*" Account_Name!="*$"

Re: How to exclude computer account name from results

sicknss — Tue, 29 Sep 2020 23:27:00 GMT

Reviving this as I am seeking an answer to the same issue and have yet to be able to find it.

What arkonner was saying is that they don't want the computer accounts to show in the results. I am trying to do the same but simply ignoring values that end in "$" is sloppy and could potentially hide valid results.

This search highlights the issue, I do not want to display results where the user matches any Workstation_Name appended with "$". The only way to make this work that I can think of is to build an array of Workstation_Name values and elminate users that match any value in the array... but I'm relatively new to Splunk and don't know how to do that yet.

index=wineventlog sourcetype="wineventlog:security" src_ip= | stats count by Workstation_Name user

Re: How to exclude computer account name from results

lazer — Fri, 06 Nov 2020 13:10:34 GMT

I like Woodcocks reply, the component below was most valuable for eliminating computer account names

Account_Name!="*$"