Splunk Search

Search for Windows logon events for usernames matching a pattern with anomalousvalue Workstation Name

ajmb
New Member

I want to start out with: EventIdentifier=4624 | AnomalousValue "Workstation Name"
...but this search returns an error. What am I doing wrong here? It's like Splunk doesn't know what the "Workstation Name" field is.

0 Karma

woodcock
Esteemed Legend

Based on your clarification, this should work:

EventIdentifier=4624 | anomalousvalue Workstation_Name
0 Karma

woodcock
Esteemed Legend

Did this work?

0 Karma

woodcock
Esteemed Legend

Are you sure that it is a field? If it is, this will work, if not you need to make the field exist:

EventIdentifier=4624 | anomalousvalue $Workstation Name$
0 Karma

ajmb
New Member

It returned the field as Workstation_Name, but I've tried:

EventIdentifier=4624 | ...

  • AnomalousValue 'Workstation_Name'
  • AnomalousValue "Workstation_Name"
  • AnomalousValue $Workstation_Name"

every single one of these returns "Error in 'anomalousvalue' command: found no qualifying results. Please verify that the field names are correct"

0 Karma

ajmb
New Member

Well that doesn't work so I guess it isn't a 'field'. This is annoying and confusing.

The event data has a section like this...

Network Information:
Workstation Name: TestClientPc
Source Network Address: 192.168.1.247
Source Port: 52404

So what the heck do I do here? Is this something I have to use eval() for?

0 Karma

woodcock
Esteemed Legend

Well obviously EventIdentifier is a field so some fields are being created. What do you get from this:

 EventIdentifier=4624 | stats first(*)

This will show you what fields do exist. Perhaps this field is being extracted as Name instead of Workstation Name.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...