How to create a simple dashboard showing AD admin account lockout events?

[blmclaws]

I am new to Splunk and have been tasked with creating a dashboard that will show detail about account lockout events. Specifically when an administrator account has been locked out, why and on what device. I don't need anything fancy right now just something that works and I can add more to it later. I have evaluated other answers to similar questions and can't seem to get any of them to work but they also seem to be more complex and I can't decipher them yet because of my limited splunk knowledge.

[amitm05 · Accepted solution]

Hi bimclaws

Assuming you are working on windows security logs for this.
Running the following SPL will give you the statics you stated above:
index="YourIndex" sourcetype="Your Windows sourcetype" EventCode=4740 |stats count values(user) as user values(signature) as action by src | rename src as Source

You might need to check for any field name changes or other tweaks that you may require.
After running the SPL, you can save it as a dashboard panel. At Dashboard panel you can further have the options of working with the visulaizations.

Hope this helps

[blmclaws]

This is what I needed and it's a great start! Thanks.