Account Locked out without DC$

[arkonner]

All domain controllers are sending the event code 644 & 4740 to windowseventlog index.

Using the search below I am able to determine the accounts locked out - As result the search provide the account name locked-out

As account name I have the DomainController$ and users name - I can't use =!DomainControler$ to display only the user name because also the users name related will be omitted -

index=wineventlog source="WinEventLog:Security" sourcetype="WinEventLog:Security" Account_Name="*" EventCode=4740 OR EventCode=644 AND Account_Name!=Guest AND Account_Name!=Administrator AND Account_Name!=Anonymous | timechart span=1h count by Account_Name

[arkonner]

Both are working well - Thanks a lot

[JDukeSplunk]

Try this.

index=wineventlog source="WinEventLog:Security" sourcetype="WinEventLog:Security" Account_Name="*" EventCode=4740 OR EventCode=644 AND Account_Name!=Guest AND Account_Name!=Administrator AND Account_Name!=Anonymous 
| eval Account_Name = mvindex(Account_Name,1) 
| eval Security_ID = mvindex(Security_ID,1)
| timechart span=1h count by Account_Name

[JDukeSplunk]

Just because im not a fan of timechart, this one will show you where the account was locked. This assumes Caller_Computer_Name is a valid field for you. Security_ID is redundant if you only have one domain.

index=wineventlog source="WinEventLog:Security" sourcetype="WinEventLog:Security" Account_Name="*" EventCode=4740 OR EventCode=644 AND Account_Name!=Guest AND Account_Name!=Administrator AND Account_Name!=Anonymous 
| eval Account_Name = mvindex(Account_Name,1) 
| eval Security_ID = mvindex(Security_ID,1)
|stats count(Account_Name) as COUNT by Account_Name Security_ID  Caller_Computer_Name

-JD

[sundareshr]

Can you restate your question. Are you wanting to remove the domain name from the Account_Name field and keep only the user name or do you want to exclude events that have only the domain name? Also, can you share a couple of sample events

[arkonner]

Hi, I am trying to explain myself better - In the raw data I have for a single event as Account_Name the userid and the DCx$

Account_Name = DC1$ Account_Name J.smith EventCode 4740
Account_Name = DC1$ Account_Name p.brown EventCode 4740
Account_Name = DC2$ Account_Name p.brown EventCode 4740

as search result using stats by Account Name

DC1$ = 2
J.smith = 1
DC2$ = 1
p.brown = 2

What I'm looking for :

j.smith = 1
p.brown = 2

Thank you in advance for the attention given