Splunk Search

How to separate name in stats for local discovered accounts?

Minasdad
Path Finder

Any advice on this search? Although it simply produces what I need, it also lumps the system name with it.

 

index=main s LogName=Security EventCode=4738 Account_Name="*"| table Account_Name | dedup Account_Name

Labels (2)
0 Karma
1 Solution

PickleRick
SplunkTrust
SplunkTrust

I'm not that much of an expert on Windows but your search most probably simply returns list of changed accounts. Since Windows uses account for machines as well, you're getting them in the results. It's not about Splunk but about how you distinguish user accounts from the machine accounts. If I remember correctly, the machine accounts have a dollar sign at the end (or at the beginning?). Filtering them out should do the trick then.

View solution in original post

0 Karma

PickleRick
SplunkTrust
SplunkTrust

I'm not that much of an expert on Windows but your search most probably simply returns list of changed accounts. Since Windows uses account for machines as well, you're getting them in the results. It's not about Splunk but about how you distinguish user accounts from the machine accounts. If I remember correctly, the machine accounts have a dollar sign at the end (or at the beginning?). Filtering them out should do the trick then.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

What is your expected output?  What is the difference between a "system name" and a "local discovered account"?  Remember, this is a Splunk board.  Most people have no knowledge about your specific data even if LogName=Security may seem obvious to you.

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...