Splunk Search

How to use eval mvindex in a search to pull values from the 2nd of two identical fields in an event?

jbleich
Path Finder

Hello fellow splunkers...

I am very new to splunk and currently what I'm trying to do is filter out windows event 4625 to see when my users are not getting their passwords correct. The event details comes up w/ 2 Account_Name's so I'm trying to use mvindex to omit the 1st one and only grab values in the second one. I'm going on the assumption that field 1 is actually 0 and field 2 is 1.....Here is the string I'm using.

EventCode=4625 | eval Account_Name=if(Account_Name="*$", (mvindex(Account_Name,1)), Account_Name)

Below is an example of the details in an event (Note: All computer names end in a $)
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: ComputerName$
Account Domain:

asimagu
Builder

it may be that $ is a character that you need to escape... did you try that?

0 Karma

jbleich
Path Finder

I've also tried this search string which will work with any machine names individually, however if I try NOT Account_Name="*$" it doesnt work. I tried that because all machine names have the $ sign at the end.

EventCode=4625 NOT Account_Name="*$" | eval Account_Name =mvindex(Account_Name,1)

It's pulling the right account name field, but i cannot ommit the ones i dont want. If I replace the *$ with a specific machine name it will go ahead and take it out.

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...