Multivalued fields

[ESIMatNeforce]

I have a problem concerming multivalued fields.

i wanted to create a dashboard which shows failed logins per user with the following query
bad password timeformat="%Y-%m-%dT%H:%M:%S" earliest="2013-11-06T13:45:00" | timechart span=1d count by Account_Name

But in the Splunk events there are 2 different values per event for Account_Name:

Account_Name:

"-"
"Administrator"

Therefore I get in my Dashboard all Accounts listet, but I also get an Account with the name "-"
(It is also the total of all events because every username also has the "-" value in it)

How to fix this issue?

Best regards

[ESIMatNeforce]

Message=An account failed to log on.

Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0

Logon Type: 3

Account For Which Logon Failed:
Security ID: NULL SID
Account Name: Andi
Account Domain: SPLUNKTEST

Detailed Authentication Information:
Logon Process: NtLmSsp
Authentication Package: NTLM
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

The result is
- Andi
8 13.11.13 00:00:00,000 1 1

How to define the search query that i don't get the results for Accountname "-"?

[somesoni2]

Could you provide some sample data before and after execution of timechart command?

[lukejadamec · Accepted solution]

Use this to select the second Account_Name. Change the 1 to a 0 to grab the first.

 eval Account_Name=mvindex(Account_Name,1)

Updated to correct the field name.

The complete search would be like this:

timeformat="%Y-%m-%dT%H:%M:%S" earliest="2013-11-06T13:45:00" | eval Account_Name=mvindex(Account_Name,1)| timechart span=1d count by Account_Name