Splunk Search

Splunk Query For Admin Who Unlocked Account

k45bryant
New Member

Hello All,

I created a query that looks for event 4767 (A user account was unlocked) and it returns the date/time of the event, the Administrator (Account_Name) who unlocked the account and the user who's account was unlocked. The problem is that it also lists the user's account under the "who unlocked the user" column. I think the query is pulling that information from the Target Account --> Account Name field. How do I exclude that from my results?

Here is my query:

index="wineventlog" EventCode=4767 user=$users$ | stats count by _time, Account_Name, user | fields - count | sort - _time
0 Karma
1 Solution

aromanauskas
Path Finder

Your answer is in the already extracted fields.

index="wineventlog" EventCode=4767 user=$users$ | stats count by _time, src_user, user | fields - count | sort - _time

View solution in original post

0 Karma

aromanauskas
Path Finder

Your answer is in the already extracted fields.

index="wineventlog" EventCode=4767 user=$users$ | stats count by _time, src_user, user | fields - count | sort - _time

0 Karma

k45bryant
New Member

That worked! Thank you soooo much. You ROCK!

0 Karma

Vijeta
Influencer

can you share some sample events?

0 Karma

k45bryant
New Member

Are you asking for the results after I run my query? I am not sure what you mean by sample events. Can you clarify your question?

0 Karma

Vijeta
Influencer

the data on which you are performing search

0 Karma

k45bryant
New Member

Sure. Here you go:

5/13/19
3:50:35.000 PM

05/13/2019 03:50:35 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4767
EventType=0
Type=Information
ComputerName=x.com
TaskCategory=User Account Management
OpCode=Info
RecordNumber=xxx
Keywords=Audit Success
Message=A user account was unlocked.

Subject:
Security ID: xxx
Account Name: xx
Account Domain: LANS
Logon ID: xx

Target Account:
Security ID: xx
Account Name:xx
Account Domain: LANS
Collapse
host = xx source = WinEventLog:Security sourcetype = WinEventLog:Security src_user = xx user = xx

0 Karma

k45bryant
New Member

I am a newbie to splunk and have no idea how to apply regex to my query. Can you help me?

0 Karma

Vijeta
Influencer

you will have to apply some regex to get the Account Name fields for user(based on target account name) and Admin (based on Subject Account Name)

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...