Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: TargetUserName - Win7 Security Event Log
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
TargetUserName - Win7 Security Event Log
I am struggling to find a text string - "TargetUserName" using SPLUNK. I have drilled down to the actual event log in question and can't get SPLUNK to display any of the data in the Event log General tab.
Could someone please advise how I can filter on TargetUserName
Thanks
Dave
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi, I am having the same issue.
The events are displayed in the dashboard but not showing the information that I am interested in.
I cant see the name of the account that I have created.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
To find a value of the field TargetUserName that is equal to Dave121:
TargetUserName="Dave121"
To search for Dave121 as plain text:
"Dave121"
If for some reason Splunk is not finding that TargetUserName is a field, then the second option should work. If you are searching Windows event logs, most of the time the username is in the User_Name or Account_Name fields. If you still are unable to find what you are looking for, please post a copy of the event.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I am trying to find the value for TargetUserName, but it would be useful to know how to find the text string too.
I know that an account that I am investigating has been used to logon to a system over the network, but searching for that account name, lets call it Dave121, doesn’t return any values.
So the ultimate question is how would find the value Dave121 for TargetUserName
Thanks
Dave
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you trying to find the value for TargetUserName or the text string TargetUserName?
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Announcing Modern Navigation: A New Era of Splunk User Experience
Modernize your Splunk Apps – Introducing Python 3.13 in Splunk
Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...
