Splunk Search

Windows Event Log 4625 - Eval Account_Name Search Issue

zward
Path Finder

Hello,

I have the following search:

index=security_wineventlog EventCode=4625 | table _time, Workstation_Name, Source_Network_Address, host, Account_Name | eval Account_Name=if(Account_Name="*$",(mvindex(Account_Name,1)), Account_Name) | eval Account_Name=if(Account_Name="-",(mvindex(Account_Name,1)), Account_Name) | eval Account_Name=if(Account_Name="ADFS",(mvindex(Account_Name,1)), Account_Name) | eval Time=strftime(_time,"%Y/%m/%d %T")

Now using the eval command, I am finding any results with "-", "ADFS", or "randomcomputername$" and instead choosing the next result for account_name. However when running the search, I am still seeing account_names with $ at the end of the account name.

Here are the results I get when I do a search:
alt text

How can I move past account names with $ in them per my search above to populate the next result for account_name? I searched google and Splunk answers and was not able to find an answer. Thank you.

0 Karma
1 Solution

maciep
Champion

What about using mvfilter to get rid of the ones you don't want?

|  eval Account_Name = mvfilter(Account_Name!="-" AND Account_Name!="ADFS" AND NOT match(Account_Name,"\$$"))

View solution in original post

0 Karma

zward
Path Finder

That worked wonderfully and is exactly what I needed, thank you Maciep!

0 Karma

maciep
Champion

What about using mvfilter to get rid of the ones you don't want?

|  eval Account_Name = mvfilter(Account_Name!="-" AND Account_Name!="ADFS" AND NOT match(Account_Name,"\$$"))
0 Karma
Get Updates on the Splunk Community!

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...