topic Re: How to generate a search to find a local account added to admin group within one hour? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-find-a-local-account-added-to-admin/m-p/329849#M98198 <P>Have you checked out gosplunk.com? There may be some relevant queries you can use as a starting point (e.g., <A href="http://gosplunk.com/?s=Local+user+admin+group&amp;cat=0">http://gosplunk.com/?s=Local+user+admin+group&amp;cat=0</A>)</P> Fri, 14 Apr 2017 18:39:33 GMT johnpusey 2017-04-14T18:39:33Z How to generate a search to find a local account added to admin group within one hour? https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-find-a-local-account-added-to-admin/m-p/329848#M98197 <P>How can I find if a local account/user has been created and then added to the admin/domain admin group within a span of certain time such as 1 hour?<BR /> Local user account codes<BR /> EventCode=4720 OR EventCode=4721 <BR /> Admin account codes<BR /> EventCode=4732 OR EventCode=4728 OR EventCode=4756<BR /> I am not able to structure it right? <BR /> Can anybody help</P> Thu, 13 Apr 2017 23:19:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-find-a-local-account-added-to-admin/m-p/329848#M98197 abdul_jabbar 2017-04-13T23:19:28Z Re: How to generate a search to find a local account added to admin group within one hour? https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-find-a-local-account-added-to-admin/m-p/329849#M98198 <P>Have you checked out gosplunk.com? There may be some relevant queries you can use as a starting point (e.g., <A href="http://gosplunk.com/?s=Local+user+admin+group&amp;cat=0">http://gosplunk.com/?s=Local+user+admin+group&amp;cat=0</A>)</P> Fri, 14 Apr 2017 18:39:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-find-a-local-account-added-to-admin/m-p/329849#M98198 johnpusey 2017-04-14T18:39:33Z