All Apps and Add-ons

Feature Suggestion - Splunk Windows TA app - WMI:UserAccounts

Path Finder

I recently enabled the WMI:UserAccounts stanza in the wmi.conf of the Windows TA app and found that the WMI:UserAccounts stanza is pulling from the Win32_Accounts class rather than the Win32_UserAccounts class. Pulling from the Win32_Accounts class pulls in all the built-in Windows classes such as "Local Accounts", "Authenticated Users", CREATOR GROUP" amongst a slew of others.

I don't know about everyone else, but I was looking specifically for the entries that show up I type "net user" at the command prompt, or view the Users directory under Local Users and Groups in computer management.

Finally, for what its worth, when using the Win32_Accounts class, I had to create an entry in my props.conf to properly extract the Name field for accounts that contained spaces.

The version of the app I'm using is 4.8.3.

0 Karma

Path Finder

If anyone else is curious, I was able to simply change the WMI:UserAccounts stanza from Win32_Accounts to Win32_UserAccounts and get the results I expected.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...