Getting Data In

How do I filter out values if they appear twice

New Member

I have this data from Windows security logs and in the message section you have 2 version of the account name: I am only interested in the value of the second account string but I get both when putting into a table. In this result set, Account Name is used in both the subject and the Account is locked section of the Message value;

If my search is:
sourcetype=WinEventLog:Security EventCode=4740 ComputerName="AD*" |table _time Account_Name Caller_Computer_Name
I get both account names;

08/08/2012 03:32:32 PM
SourceName=Microsoft Windows security auditing.
TaskCategory=User Account Management
Keywords=Audit Success
Message=A user account was locked out.

Security ID: S-1-5-18
Account Name: ADSERVER3$
Account Domain: MYDOMIAN
Logon ID: 0x3e7

Account That Was Locked Out:
Security ID: S-1-5-21-2108891353-1649483382-1341851483-2087
Account Name: mraccount

Additional Information:
Caller Computer Name: MAILSERVER

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee
0 Karma

Splunk Employee
Splunk Employee

Use multivalue fields and extract the one you want using mvindex.


0 Karma

New Member

awesome.. thanks worked

0 Karma
Get Updates on the Splunk Community!

Index This | A sphere has three, a circle has two, and a point has zero. What is it?

September 2023 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Build Scalable Security While Moving to Cloud - Guide From Clayton Homes

 Clayton Homes faced the increased challenge of strengthening their security posture as they went through ...

Mission Control | Explore the latest release of Splunk Mission Control (2.3)

We’re happy to announce the release of Mission Control 2.3 which includes several new and exciting features ...