Splunk Query For Admin Who Unlocked Account

[k45bryant]

Hello All,

I created a query that looks for event 4767 (A user account was unlocked) and it returns the date/time of the event, the Administrator (Account_Name) who unlocked the account and the user who's account was unlocked. The problem is that it also lists the user's account under the "who unlocked the user" column. I think the query is pulling that information from the Target Account --> Account Name field. How do I exclude that from my results?

Here is my query:

index="wineventlog" EventCode=4767 user=$users$ | stats count by _time, Account_Name, user | fields - count | sort - _time

[aromanauskas · Accepted solution]

Your answer is in the already extracted fields.

index="wineventlog" EventCode=4767 user=$users$ | stats count by _time, src_user, user | fields - count | sort - _time

[k45bryant]

That worked! Thank you soooo much. You ROCK!

[Vijeta]

can you share some sample events?

[k45bryant]

Are you asking for the results after I run my query? I am not sure what you mean by sample events. Can you clarify your question?

[Vijeta]

the data on which you are performing search

[k45bryant]

Sure. Here you go:

5/13/19
3:50:35.000 PM

05/13/2019 03:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4767
EventType=0
Type=Information
ComputerName=x.com
TaskCategory=User Account Management
OpCode=Info
RecordNumber=xxx
Keywords=Audit Success
Message=A user account was unlocked.

Subject:
Security ID: xxx
Account Name: xx
Account Domain: LANS
Logon ID: xx

Target Account:
Security ID: xx
Account Name:xx
Account Domain: LANS
Collapse
host = xx source = WinEventLog:Security sourcetype = WinEventLog:Security src_user = xx user = xx

[k45bryant]

I am a newbie to splunk and have no idea how to apply regex to my query. Can you help me?

[Vijeta]

you will have to apply some regex to get the Account Name fields for user(based on target account name) and Admin (based on Subject Account Name)