Account Lockout

[maxwell2k19]

Hi all

One of my user lets say maxwell is getting locked frequently. i want to check logs for last 7 days. i am using the below query but i am not getting any output.
i have 4 domain controllers(dctr01,dctr02,dctr03,dctr04).

index=winevenlog sourcetype=wineventlog:security Account_Name=maxwell EventCode=4740 earliest=-h (host="dctr01*" OR host="dctr02*" OR host="dctr03*" OR host="dctr04*")
| table _time Caller_Computer_Name Account_Name EventCode Source_Network_Address Workstation_Name

[dtburrows3]

I see in your original post that you mention searching over the last 7 days but your SPL has hardcoded "earliest=-1h" in it. This will override the timerange input into the time selector.
I also have some Windows event logs indexing in my local instance and by default, it looks like it is the source=WinEventLog:Security and sourcetype=WinEventLog

So maybe try updating your search to something like this and see if you get expected results.

index=<your_index> sourcetype=WinEventLog source="WinEventLog:Security" Account_Name=maxwell EventCode=4740 host IN ("dctr01*", "dctr02*", "dctr03*", "dctr04*") earliest=-7d@d latest=now
    | table _time Caller_Computer_Name Account_Name EventCode Source_Network_Address Workstation_Name

[marnall]

If we assume that the Windows Event logs including EventCode 4740 are indeed being indexed into index=winevenlog and sourcetype wineventlog:security (double-check those names!) and that maxwell was indeed locked out within the past 1 hour, then try doing a keyword search for maxwell to see if you can get the raw log:

e.g.

index=wineventlog sourcetype=wineventlog:security maxwell 4740

(Hopefully the logs that match the literal words maxwell and 4740 will be the EventCode=4740 for Maxwell, or at least small enough to comb through)

After that, progressively re-add those search filters until one of them removes the entry for maxwell, then you can troubleshoot why that search filter is not working. (e.g. field extraction error?)