Splunk Search

Windows Event Log 4625 - Eval Account_Name Search Issue

zward
Path Finder

Hello,

I have the following search:

index=security_wineventlog EventCode=4625 | table _time, Workstation_Name, Source_Network_Address, host, Account_Name | eval Account_Name=if(Account_Name="*$",(mvindex(Account_Name,1)), Account_Name) | eval Account_Name=if(Account_Name="-",(mvindex(Account_Name,1)), Account_Name) | eval Account_Name=if(Account_Name="ADFS",(mvindex(Account_Name,1)), Account_Name) | eval Time=strftime(_time,"%Y/%m/%d %T")

Now using the eval command, I am finding any results with "-", "ADFS", or "randomcomputername$" and instead choosing the next result for account_name. However when running the search, I am still seeing account_names with $ at the end of the account name.

Here are the results I get when I do a search:
alt text

How can I move past account names with $ in them per my search above to populate the next result for account_name? I searched google and Splunk answers and was not able to find an answer. Thank you.

0 Karma
1 Solution

maciep
Champion

What about using mvfilter to get rid of the ones you don't want?

|  eval Account_Name = mvfilter(Account_Name!="-" AND Account_Name!="ADFS" AND NOT match(Account_Name,"\$$"))

View solution in original post

0 Karma

zward
Path Finder

That worked wonderfully and is exactly what I needed, thank you Maciep!

0 Karma

maciep
Champion

What about using mvfilter to get rid of the ones you don't want?

|  eval Account_Name = mvfilter(Account_Name!="-" AND Account_Name!="ADFS" AND NOT match(Account_Name,"\$$"))
0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: https://bsidessplunk.com CFP Site: https://bsidessplunk.com/cfp CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...