Splunk Search

How to create a search for Account Creation Event ID 4720?

lsufan861
New Member

I'm a novice user to Splunk and need a simple index search for account creation, time, and creator.  I'm on  closed domain and don't have the typical add ons.  Thank you in advance.

Labels (1)
Tags (1)
0 Karma

General_Talos
Path Finder

Try this if this helps

 

index=* source="WinEventLog:Security" (EventCode=4720 OR EventCode=624)
    | eval CreatedBy = mvindex(Account_Name,0) 
    | eval New_User = mvindex(Account_Name,1) 
    | search CreatedBy=*
    | table _time EventCode CreatedBy New_User

cwheeler33
Engager

this post saved me so much time!!!
Thank you

note1: Only need EventCode=624 if you have Windows 2008 or older systems.
note2: don't need this line, but the rest is perfect.

| search CreatedBy=*

 

0 Karma