How to create a search for Account Creation Event ID 4720?

[lsufan861]

I'm a novice user to Splunk and need a simple index search for account creation, time, and creator.  I'm on  closed domain and don't have the typical add ons.  Thank you in advance.

[General_Talos]

Try this if this helps

index=* source="WinEventLog:Security" (EventCode=4720 OR EventCode=624)
    | eval CreatedBy = mvindex(Account_Name,0) 
    | eval New_User = mvindex(Account_Name,1) 
    | search CreatedBy=*
    | table _time EventCode CreatedBy New_User

[cwheeler33]

this post saved me so much time!!!
Thank you

note1: Only need EventCode=624 if you have Windows 2008 or older systems.
note2: don't need this line, but the rest is perfect.

| search CreatedBy=*