Splunk Search

System and Nobody had no roles

dcrooks_cbp
New Member

I am trying to get the System access attempts with invalid credentials. Folks with unknown user names. I am using the following search part: index=_internal sourcetype=splunkd user=* component=UserManagerPro

There are a ton of messages with the following:
message="user=\"system\" had no roles" and message="user=\"nobody\" had no roles"

I believe they can just be filtered out and I am using version 7.0.4

DLC

Tags (1)
0 Karma

bohanlon_splunk
Splunk Employee
Splunk Employee
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hi @dcrooks_cbp,
Please try changing your part of query with this:

index=_internal sourcetype=splunkd UserManagerPro NOT TERM("had no roles")

Hope this helps!!

0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

Hi @dcrooks_cbp,
Can you please provide a sample raw event? As on my dev instance I do not have any event with this criteria.

0 Karma

dcrooks_cbp
New Member

11-01-2018 13:49:01.942 +0000 ERROR UserManagerPro - user="system" had no roles

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...