Splunk Search

How to use eval mvindex in a search to pull values from the 2nd of two identical fields in an event?

Path Finder

Hello fellow splunkers...

I am very new to splunk and currently what I'm trying to do is filter out windows event 4625 to see when my users are not getting their passwords correct. The event details comes up w/ 2 Account_Name's so I'm trying to use mvindex to omit the 1st one and only grab values in the second one. I'm going on the assumption that field 1 is actually 0 and field 2 is 1.....Here is the string I'm using.

EventCode=4625 | eval AccountName=if(AccountName="*$", (mvindex(AccountName,1)), AccountName)

Below is an example of the details in an event (Note: All computer names end in a $)
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: ComputerName$
Account Domain:

Builder

it may be that $ is a character that you need to escape... did you try that?

0 Karma

Path Finder

I've also tried this search string which will work with any machine names individually, however if I try NOT Account_Name="*$" it doesnt work. I tried that because all machine names have the $ sign at the end.

EventCode=4625 NOT AccountName="*$" | eval AccountName =mvindex(Account_Name,1)

It's pulling the right account name field, but i cannot ommit the ones i dont want. If I replace the *$ with a specific machine name it will go ahead and take it out.

0 Karma