Splunk Search

How do you find the disabled usernames along with the status of their respective adm-usernames?

deepak007
Explorer

I have 2 types of account for the same user's like
1. username
2. adm-username

As a requirement, I need to find the disabled usernames along with the status of their respective adm-usernames

I have the query to find the disabled usernames, but I need to know the status of their adm-username account status.

Tags (1)
0 Karma

whrg
Motivator

I presume you have two searches:
- one search for finding all disabled users
- one search for finding all adm-users and their respective status

I suggest you use the join command:

index=... your search for all disabled users | dedup username | table username
| eval adm_username="adm-".username
| join type=left adm_username [search index=... your search for all adm-users | rename username as adm_username status as adm_status | table adm_username,adm_status]

This should get you a table with the columns: username, adm_username, adm_status

0 Karma

deepak007
Explorer

not getting what I need to, its just changing the name by prefixing the ADM- in front of username.

maybe I was not clear with the query, I need to search the existing ADM accounts present or not for the users that are disabled, as we dont have adm account for all the user's

running this query not solving the issue

sourcetype="WinEventLog:Security" EventCode=4725 user!="$" | dedup user | table user
| eval adm_username="adm-".user
| join type=left adm_username [search sourcetype="WinEventLog:Security" EventCode=4725 user!="
$" OR user="adm-*" | rename user as adm_username status as adm_status | table adm_username,adm_status]

0 Karma

whrg
Motivator

So do you just want to list all ADM accounts which are disabled? Or do you want to list all ADM accounts with their respective status (enabled/disabled)? Perhaps you could provide an example as to what the expected results should look like.

0 Karma

deepak007
Explorer

Hi Whrg,

basically I want the ADM accounts which are left out.
in our organization there is a process of disabling the user accounts not the adm accounts, i need something that tells me the adm account is left for the respective user account which is disabled.
so that we can manually disable them

note: ADM account is not for all the user's in the organization, its just 40% of the users have ADM account

0 Karma

whrg
Motivator

Hello @deepak007, do you have a search for finding the status of an adm-username?
How are usernames and adm-usernames connected? Is it just the prefix "adm-" before the username?

0 Karma

deepak007
Explorer

yes we have 2 types of user names in our environment

  1. username
  2. adm-username

same user holds both the accounts, but both the accounts are different

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...