Getting Data In

How to create a table with the names of the users deleted?

hichem_khalfi
Path Finder

I want to have a table of deleted accounts with the attributes time, adminstrator, user, message but the administrator and users fields still remain empty

index = msad source=wineventlog:security EventCode=4726
| rex field=member_dn "(?<Administrator> S+)s+(?<User> S+)"
| table _time Administrator User action signature

and that I checked event raw, I noticed that the field membr_dn is empty have a solution?

Labels (2)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If the field is empty, what should be in it?

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...