Lookup on text file not working

[johnblakley]

I wanted to use a file to use for usernames. For example, I want to know when the following people's account information changes:

usernames.csv:

useraccounts
"jim smith"
"john temp"
"bob lynn"

If the user above has their password changed, I want to be notified. I have the csv uploaded into splunk, but I'm not sure how to use it to compare for this reason. The search I've tried, which isn't even close to working, is below:

sourcetype=* | lookup vipUserAccounts useraccounts OUTPUT vips | stats count by vips

This was just to test if the lookup file was even seeing the three accounts and I get an error. So, what I'm looking for is to be able to alert on password changes when one of the accounts above is changed. The alert will be ran in realtime, and I'm trying to do this so I can just edit the text file to add/remove users.

Thanks!

[johnblakley]

Thank you for the response..

I'm wanting a list like the one above to be used for usernames. What I'm searching for is a standard Windows event log "EventCode=4724". I tried the search below, but it returns nothing:

host="server" EventCode=4724 [| inputlookup userAccountsToMonitor.csv | table useraccounts]

The userAccountsToMonitor.csv is the real filename, and the text above is listed. The result should be a couple of entries if one of the users in the text file is found. Does that make sense? As I'm writing it, it's starting to confuse me... lol

[DalJeanis]

@johnblakley - the first thing you need to do is verify that events with EventCode=4724 are being logged in your system, and that you have the index and field name correct to find them. Just execute a quick search to find one example.

In my system, for instance, the correct search would be something like...

index=(mywindowsindex) EventID=4724 | head 1

If that returns a valid record, then grab the userid from that record, which for instance might be called AccountName, and try this ...

 index=(mywindowsindex) EventID=4724 [| makeresults | eval AccountName=(theuseridyougrabbed) | table AccountName ] | head 1

...and see if you still get that same record. Once you have THAT syntax correct, then you use this in the braces [] in that spot your search...

[| inputlookup userAccountsToMonitor.csv | rename useraccounts as AccountName | table AccountName]

To work, all of the above require you to determine what the name of the event code and user id fields are in your system, and what index they are on.

[somesoni2]

Assuming your logs which includes the password change events have a fields called useraccounts with values in exact format/value, try like this

your base search to select password change events [| inputlookup usernames.csv | table useraccounts ] 

This will only select events for useraccounts matching what you specified in usernames.csv lookup table file, so now you can alert if number of events from above search is greater than 0.