Dashboards & Visualizations

How to create a simple dashboard showing AD admin account lockout events?

blmclaws
Engager

I am new to Splunk and have been tasked with creating a dashboard that will show detail about account lockout events. Specifically when an administrator account has been locked out, why and on what device. I don't need anything fancy right now just something that works and I can add more to it later. I have evaluated other answers to similar questions and can't seem to get any of them to work but they also seem to be more complex and I can't decipher them yet because of my limited splunk knowledge.

0 Karma
1 Solution

amitm05
Builder

Hi bimclaws

Assuming you are working on windows security logs for this.
Running the following SPL will give you the statics you stated above:
index="YourIndex" sourcetype="Your Windows sourcetype" EventCode=4740 |stats count values(user) as user values(signature) as action by src | rename src as Source

You might need to check for any field name changes or other tweaks that you may require.
After running the SPL, you can save it as a dashboard panel. At Dashboard panel you can further have the options of working with the visulaizations.

Hope this helps

View solution in original post

amitm05
Builder

Hi bimclaws

Assuming you are working on windows security logs for this.
Running the following SPL will give you the statics you stated above:
index="YourIndex" sourcetype="Your Windows sourcetype" EventCode=4740 |stats count values(user) as user values(signature) as action by src | rename src as Source

You might need to check for any field name changes or other tweaks that you may require.
After running the SPL, you can save it as a dashboard panel. At Dashboard panel you can further have the options of working with the visulaizations.

Hope this helps

blmclaws
Engager

This is what I needed and it's a great start! Thanks.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...