Splunk Search

How to use eval mvindex in a search to pull values from the 2nd of two identical fields in an event?

jbleich
Path Finder

Hello fellow splunkers...

I am very new to splunk and currently what I'm trying to do is filter out windows event 4625 to see when my users are not getting their passwords correct. The event details comes up w/ 2 Account_Name's so I'm trying to use mvindex to omit the 1st one and only grab values in the second one. I'm going on the assumption that field 1 is actually 0 and field 2 is 1.....Here is the string I'm using.

EventCode=4625 | eval Account_Name=if(Account_Name="*$", (mvindex(Account_Name,1)), Account_Name)

Below is an example of the details in an event (Note: All computer names end in a $)
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: ComputerName$
Account Domain:

asimagu
Builder

it may be that $ is a character that you need to escape... did you try that?

0 Karma

jbleich
Path Finder

I've also tried this search string which will work with any machine names individually, however if I try NOT Account_Name="*$" it doesnt work. I tried that because all machine names have the $ sign at the end.

EventCode=4625 NOT Account_Name="*$" | eval Account_Name =mvindex(Account_Name,1)

It's pulling the right account name field, but i cannot ommit the ones i dont want. If I replace the *$ with a specific machine name it will go ahead and take it out.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...