Getting Data In

How to create a table with the names of the users deleted?

hichem_khalfi
Path Finder

I want to have a table of deleted accounts with the attributes time, adminstrator, user, message but the administrator and users fields still remain empty

index = msad source=wineventlog:security EventCode=4726
| rex field=member_dn "(?<Administrator> S+)s+(?<User> S+)"
| table _time Administrator User action signature

and that I checked event raw, I noticed that the field membr_dn is empty have a solution?

Labels (2)
Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

If the field is empty, what should be in it?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...