Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- help on a query - password changed on first login ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey everyone,
Im trying to come up with a way to get a table stating that, a user was created in splunk had the "Require password change on first login" box checked,
is there any way to get that information?
Thanks in advanced
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
See if you have the following fields in your audit index:
index=audit action=create_user
You should see within the raw log the passwordState field and the value should be along the lines of force password change. You can just rex that field out with this
| rex field=_raw "passwordState=(?<passwordState>[^\s]+)"
Then all you need to do from there is just table the fields:
| table _time, index, action, passwordState, *
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
See if you have the following fields in your audit index:
index=audit action=create_user
You should see within the raw log the passwordState field and the value should be along the lines of force password change. You can just rex that field out with this
| rex field=_raw "passwordState=(?<passwordState>[^\s]+)"
Then all you need to do from there is just table the fields:
| table _time, index, action, passwordState, *
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
THANK YOUUUUUU, you just made worth my 4 hours looking for it
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
PS: the index is _audit not just audit
Reduce and Transform Your Firewall Data with Splunk Data Management
Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...
Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions
