Dashboards & Visualizations
Highlighted

How to create a simple dashboard showing AD admin account lockout events?

Engager

I am new to Splunk and have been tasked with creating a dashboard that will show detail about account lockout events. Specifically when an administrator account has been locked out, why and on what device. I don't need anything fancy right now just something that works and I can add more to it later. I have evaluated other answers to similar questions and can't seem to get any of them to work but they also seem to be more complex and I can't decipher them yet because of my limited splunk knowledge.

0 Karma
Highlighted

Re: How to create a simple dashboard showing AD admin account lockout events?

Builder

Hi bimclaws

Assuming you are working on windows security logs for this.
Running the following SPL will give you the statics you stated above:
index="YourIndex" sourcetype="Your Windows sourcetype" EventCode=4740 |stats count values(user) as user values(signature) as action by src | rename src as Source

You might need to check for any field name changes or other tweaks that you may require.
After running the SPL, you can save it as a dashboard panel. At Dashboard panel you can further have the options of working with the visulaizations.

Hope this helps

View solution in original post

Highlighted

Re: How to create a simple dashboard showing AD admin account lockout events?

Engager

This is what I needed and it's a great start! Thanks.

0 Karma