Splunk Search

How to use eval mvindex in a search to pull values from the 2nd of two identical fields in an event?

Path Finder

Hello fellow splunkers...

I am very new to splunk and currently what I'm trying to do is filter out windows event 4625 to see when my users are not getting their passwords correct. The event details comes up w/ 2 Account_Name's so I'm trying to use mvindex to omit the 1st one and only grab values in the second one. I'm going on the assumption that field 1 is actually 0 and field 2 is 1.....Here is the string I'm using.

EventCode=4625 | eval Account_Name=if(Account_Name="*$", (mvindex(Account_Name,1)), Account_Name)

Below is an example of the details in an event (Note: All computer names end in a $)
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: ComputerName$
Account Domain:


it may be that $ is a character that you need to escape... did you try that?

0 Karma

Path Finder

I've also tried this search string which will work with any machine names individually, however if I try NOT Account_Name="*$" it doesnt work. I tried that because all machine names have the $ sign at the end.

EventCode=4625 NOT Account_Name="*$" | eval Account_Name =mvindex(Account_Name,1)

It's pulling the right account name field, but i cannot ommit the ones i dont want. If I replace the *$ with a specific machine name it will go ahead and take it out.

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...