Splunk Search

Splitting Entries into 2 columns for same field

sharadkapurala
New Member

I need AD auth events and some have multiple entries for Account Name field. One entry is a hyphen (-). Can someone help me build a query to split these into 2 columns, so I can use the entry with the value and not the one with hyphen (-)

Subject:
Security ID: S-1-0-0
Account Name: -
Account Domain: -
Logon ID: 0X0

Logon Type: 3

Account For which Logon failed:

Security ID: S-1-0-0
Account Name: xyz
Account Domain: domain.local

I need only the Account name information in the event where logon failed. But when I use an eval, am unable to get only 'xyz'

Any help is appreciated.

R
Sharad

0 Karma

TiagoTLD1
Communicator

Is this data of ONE SINGLE EVENT? I mean, you have one event with two Account Name ?

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...