Is there a way to simplify my search or another approach instead of using mvindex multiple times to get the expected values?

[xavierpaul]

Hi Fellow Splunkers,

I need to create a report for this event codes.

4720 A user account was created.
4722 A user account was enabled.
4723 An attempt was made to change an account's password.
4724 An attempt was made to reset an accounts password.
4725 A user account was disabled.
4726 A user account was deleted.
4738 A user account was changed.
4740 A user account was locked out.
4767 A user account was unlocked.
4780 The ACL was set on accounts which are members of administrators groups.
4781 The name of an account was changed.
4794 An attempt was made to set the Directory Services Restore Mode administrator password
5376 Credential Manager credentials were backed up.
5377 Credential Manager credentials were restored from a backup.

Most of the eventcodes have some two values on the fields, that's why fI need to use mvindex to get the appropriate values.

Here is my current search string. I want to know how to simplify it or what is the correct approach for this use case so I can have correct values and normalize values that all fields should be common to be used at the result.

Thank you in advance.

sourcetype=WinEventLog:Security (EventCode=4781 OR EventCode=4720 OR EventCode=4722 OR EventCode=4723 OR EventCode=4724 OR EventCode=4725 OR EventCode=4726 OR EventCode=4738 OR EventCode=4767) NOT (Account_Name="*$" OR Account_Name="ANONYMOUS LOGON") earliest=-24h@h 
| eval Account_Domain=(mvindex(Account_Domain,0))
| eval Changeby=mvindex(Account_Name,0) 
| eval TargetUser=mvindex(Account_Name,1)
| eval Message=split(Message,".")  
| eval Message=mvindex(Message,1)
| eval Date=strftime(_time, "%m/%d/%y %H:%M:%S") 
|append [search sourcetype=WinEventLog:Security (EventCode=4740) earliest=-24h@h
| eval Account_Domain=(mvindex(Account_Domain,0))
| eval Changeby=mvindex(Account_Name,1) 
| eval TargetUser=if(EventCode=4740,mvindex(Account_Name,1),TargetUser)
| eval Message=split(Message,".")  
| eval Message=mvindex(Message,1)
| eval Date=strftime(_time, "%m/%d/%y %H:%M:%S")]
| append [search sourcetype=WinEventLog:Security (EventCode=4781) earliest=-24h@h
| eval Account_Domain=(mvindex(Account_Domain,0))
| eval Changeby=mvindex(Account_Name,0) 
| eval TargetUser=mvindex(Account_Name,1)
| eval Alert = "From  "  .Old_Account_Name + " To  ".New_Account_Name
| eval Date=strftime(_time, "%m/%d/%y %H:%M:%S")]
| table Date, EventCode, Changeby TargetUser Old_Account_Name EventCodeDescription, Account_Domain, Caller_Computer_Name, Message, Short_Message, Alert
| sort -Date

[somesoni2 · Accepted solution]

Give this a try

sourcetype=WinEventLog:Security (EventCode=4781 OR EventCode=4720 OR EventCode=4722 OR EventCode=4723 OR EventCode=4724 OR EventCode=4725 OR EventCode=4726 OR EventCode=4738 OR EventCode=4767) NOT (Account_Name="*$" OR Account_Name="ANONYMOUS LOGON") earliest=-24h@h 
 | eval Account_Domain=(mvindex(Account_Domain,0))
 | eval Changeby=if(EventCode="4740",mvindex(Account_Name,1), mvindex(Account_Name,0) )
 | eval TargetUser=if(EventCode=4740,TargetUser, mvindex(Account_Name,1))
 | eval Message=split(Message,".")  
 | eval Message=mvindex(Message,1)
 | eval Date=strftime(_time, "%m/%d/%y %H:%M:%S") 
 | eval Alert = if(EventCode="4781","From  ".Old_Account_Name." To  ".New_Account_Name,null())
 | table Date, EventCode, Changeby TargetUser Old_Account_Name EventCodeDescription, Account_Domain, Caller_Computer_Name, Message, Short_Message, Alert
 | sort -Date

[xavierpaul]

Thank you sir. here is the final.

sourcetype=WinEventLog:Security (EventCode=4781 OR EventCode=4720 OR EventCode=4722 OR EventCode=4723 OR EventCode=4724 OR EventCode=4725 OR EventCode=4726 OR EventCode=4738 OR EventCode=4767) NOT (Account_Name="*$" OR Account_Name="ANONYMOUS LOGON") earliest=-24h
  | append [search sourcetype=WinEventLog:Security (EventCode=4740) earliest=-24h]
  | eval Account_Domain=(mvindex(Account_Domain,0))
  | eval Changeby=if(EventCode="4740",mvindex(Account_Name,1), mvindex(Account_Name,0) )
  | eval TargetUser=if(EventCode=4740,TargetUser, mvindex(Account_Name,1))
  | eval Message=split(Message,".")  
  | eval Message=mvindex(Message,1)
  | eval Date=strftime(_time, "%m/%d/%y %H:%M:%S") 
  | eval AccountChange = if(EventCode="4781","From  ".Old_Account_Name." To  ".New_Account_Name,null())
  | dedup Date, EventCode, Changeby TargetUser signature , Account_Domain
  | table Date, EventCode, Changeby, TargetUser, signature , Account_Domain, Account_Change
  | sort -Date

[Richfez]

While this may affect a lot more than just this problem, if you are using a later version of the Windows TA (4.8+ for sure, perhaps slightly older might work too but before 4.7 it wasn't working right) you could turn on renderXml=true on all of the inputs involved. The parsing of the Xml events is far better, with things like targetUser and sourceUser instead of just two "User" fields. (That was off the top of my head, not sure that's exactly right but it it correct in the abstract.).

TEST though, there are a lot of changes when you switch to Xml logs.

I think it is worth investigating, though.

[xavierpaul]

awesome!! ill try that. thanks for the info