Splunk Search

How to separate name in stats for local discovered accounts?

Minasdad
Path Finder

Any advice on this search? Although it simply produces what I need, it also lumps the system name with it.

 

index=main s LogName=Security EventCode=4738 Account_Name="*"| table Account_Name | dedup Account_Name

Labels (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

I'm not that much of an expert on Windows but your search most probably simply returns list of changed accounts. Since Windows uses account for machines as well, you're getting them in the results. It's not about Splunk but about how you distinguish user accounts from the machine accounts. If I remember correctly, the machine accounts have a dollar sign at the end (or at the beginning?). Filtering them out should do the trick then.

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

I'm not that much of an expert on Windows but your search most probably simply returns list of changed accounts. Since Windows uses account for machines as well, you're getting them in the results. It's not about Splunk but about how you distinguish user accounts from the machine accounts. If I remember correctly, the machine accounts have a dollar sign at the end (or at the beginning?). Filtering them out should do the trick then.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

What is your expected output?  What is the difference between a "system name" and a "local discovered account"?  Remember, this is a Splunk board.  Most people have no knowledge about your specific data even if LogName=Security may seem obvious to you.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...