Splunk Search

Splunk Query For Admin Who Unlocked Account

k45bryant
New Member

Hello All,

I created a query that looks for event 4767 (A user account was unlocked) and it returns the date/time of the event, the Administrator (Account_Name) who unlocked the account and the user who's account was unlocked. The problem is that it also lists the user's account under the "who unlocked the user" column. I think the query is pulling that information from the Target Account --> Account Name field. How do I exclude that from my results?

Here is my query:

index="wineventlog" EventCode=4767 user=$users$ | stats count by _time, Account_Name, user | fields - count | sort - _time
0 Karma
1 Solution

aromanauskas
Path Finder

Your answer is in the already extracted fields.

index="wineventlog" EventCode=4767 user=$users$ | stats count by _time, src_user, user | fields - count | sort - _time

View solution in original post

0 Karma

aromanauskas
Path Finder

Your answer is in the already extracted fields.

index="wineventlog" EventCode=4767 user=$users$ | stats count by _time, src_user, user | fields - count | sort - _time

0 Karma

k45bryant
New Member

That worked! Thank you soooo much. You ROCK!

0 Karma

Vijeta
Influencer

can you share some sample events?

0 Karma

k45bryant
New Member

Are you asking for the results after I run my query? I am not sure what you mean by sample events. Can you clarify your question?

0 Karma

Vijeta
Influencer

the data on which you are performing search

0 Karma

k45bryant
New Member

Sure. Here you go:

5/13/19
3:50:35.000 PM

05/13/2019 03:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4767
EventType=0
Type=Information
ComputerName=x.com
TaskCategory=User Account Management
OpCode=Info
RecordNumber=xxx
Keywords=Audit Success
Message=A user account was unlocked.

Subject:
Security ID: xxx
Account Name: xx
Account Domain: LANS
Logon ID: xx

Target Account:
Security ID: xx
Account Name:xx
Account Domain: LANS
Collapse
host = xx source = WinEventLog:Security sourcetype = WinEventLog:Security src_user = xx user = xx

0 Karma

k45bryant
New Member

I am a newbie to splunk and have no idea how to apply regex to my query. Can you help me?

0 Karma

Vijeta
Influencer

you will have to apply some regex to get the Account Name fields for user(based on target account name) and Admin (based on Subject Account Name)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...