Splunk Search

How to separate name in stats for local discovered accounts?

Minasdad
Path Finder

Any advice on this search? Although it simply produces what I need, it also lumps the system name with it.

 

index=main s LogName=Security EventCode=4738 Account_Name="*"| table Account_Name | dedup Account_Name

Labels (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

I'm not that much of an expert on Windows but your search most probably simply returns list of changed accounts. Since Windows uses account for machines as well, you're getting them in the results. It's not about Splunk but about how you distinguish user accounts from the machine accounts. If I remember correctly, the machine accounts have a dollar sign at the end (or at the beginning?). Filtering them out should do the trick then.

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

I'm not that much of an expert on Windows but your search most probably simply returns list of changed accounts. Since Windows uses account for machines as well, you're getting them in the results. It's not about Splunk but about how you distinguish user accounts from the machine accounts. If I remember correctly, the machine accounts have a dollar sign at the end (or at the beginning?). Filtering them out should do the trick then.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

What is your expected output?  What is the difference between a "system name" and a "local discovered account"?  Remember, this is a Splunk board.  Most people have no knowledge about your specific data even if LogName=Security may seem obvious to you.

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...