Splunk Search

How to edit my search to limit results to a specific user?

cjsweeney1
Explorer

Hi i'm working w/ the below search and getting good results for all currently logged in user accounts but would anyone know how to search for a specific account? For example Tom Smith or tsmith?

Thanks...

sourcetype="WinEventLog:Security" OR (EventCode=540 OR EventCode=4624) NOT (user=*$ OR user="ANONYMOUS LOGON" OR user=SYSTEM OR user=services OR user=Unknown) 
 | stats dc(src_ip) as Number_logged_hosts, values(src_ip) as "Logins IPs", values(dvc) as "Domains Controller", count by user, ComputerName
 | rename user as Users, count as Total_time_logged_in 
Tags (2)
0 Karma

DalJeanis
Legend

change

 NOT (user=*$ OR user="ANONYMOUS LOGON" OR user=SYSTEM OR user=services OR user=Unknown) 

to

user=tsmith

assuming that's the format of your user names in your logs.

somesoni2
Revered Legend

You may need to use wild-cards. Best option would be to check how user name is available in your logs.

cjsweeney1
Explorer

I thought of that i'll try it...thanks!!

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...