Splunk Search Not Returning Complete Results

[SplunkUserD]

The intention of this correlation search is to find all new local admin accounts on end user devices. Problem is, when using WinEventLog:Security EventCode 4732, a good number of the users have "-" as the user name and only provide the SID. We attempted to alleviate the issue by looking up the user name by using WinEventLog:Security EventCodes 4720 and 4738 along side using a index that populates our active directory (MSAD) information. Most of the searches return a user name, but, not all. When I attempt to search for the SID information in the active directory index (MSAD), the search completes successfully, but, the same information is not pulled from the correlation search.

Below is my current search.

index=wineventlog eventtype=wineventlog_security EventCode=4732 Group_Name=Administrators | eval user_sid=mvindex(Security_ID,1) | join type=left user_sid [search index=wineventlog eventtype=wineventlog_security EventCode=4720 OR EventCode=4738 | eval user_sid=mvindex(Security_ID,1)] | join type=left user_sid [search index=msad | eval user_sid=objectSid | rename name as user]

[tscroggins]

@SplunkUserD 

All searches will run with the same earliest and latest time values. Try manually adding earliest and latest values to your index=msad subsearch to accommodate the frequency of your AD input, e.g. earliest=-24h latest=now.

You may also have more consistent results using the ldapsearch command appropriately configured to query your AD domain. You could try mapping your search results over ldapsearch to look up individual SID values.