About jspatton

jspatton · ‎07-11-2013

That is pretty awesome thanks! I also spoke with Darryl Burns from Splunk and his solution was to pipe the query through xmlkv, this maps out the underlying XML from Windows so Splunk can see those sub fields. sourcetype="WinEventLog:Security" AND EventCode=4720| xmlkv But I really like how you laid that out in table format!

jspatton · ‎07-11-2013

Here is where I went. http://regexhero.net/tester/

jspatton · ‎07-11-2013

So I went to an online regex checker, pasted in the contents of the event, and just typed in SAM Account Name: as the search, and that worked.

jspatton · ‎07-11-2013

Account Name is, but with this particular event there are multiples of that, the first one is the account name used to create the second account name 😉 so, I would like pull in SAM Account Name, that doesn't appear to be a thing.

jspatton · ‎07-11-2013

I think what I want is to do field extraction, and ideally I would like to extract SAM Account Name, but when I do that in the field extraction page, it tells me that, "No regex could be learned. Try providing different examples or restriction"

jspatton · ‎07-11-2013

That sounds right, but when I try to do that, it doesn't work, or more likely I don't know what I'm doing wrong. How would I do that?

jspatton · ‎07-11-2013

Sorry it's been so long since I've gotten back to this, but here is an example of what this event looks like. http://social.technet.microsoft.com/wiki/contents/articles/17055.event-ids-when-a-new-user-account-is-created-on-active-directory.aspx 4720 is the first example and you can see how it looks, when I click show the next 50 lines, basically that is what I see. I'm trying to extract just the pertinent information that I specified in the original post. Thanks,

jspatton · ‎06-17-2013

correct. its also not formatted terribly well either...sigh

jspatton · ‎06-17-2013

I get that, but I think the disconnect is that field1-3 only appear to live in the _raw data of the event. If you open up an event in the eventviewer, this is the data contained in the window that describes the event, such as a new user was created...does that make sense?

jspatton · ‎06-17-2013

I'm looking to create a view of the number of user accounts that have been created in the domain in the past 24 hours. Here is my query, and my timeframe is last 24hrs. sourcetype="WinEventLog:Security" AND EventCode=4720 The view that comes back is very abbreviated, I have to click show all 50 lines to get at the info I need. What I would like to see is the date, time, server, the user who created the account, and the created account name. This is trivial for me to do in powershell, but I'd like to have a nice dashboard that shows this for more users than just myself.

Posts	10
Solutions	0
Karma Given	1
Karma Received	0
Member Since	‎06-17-2013

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Windows Security Log Formatting

Re: Windows Security Log Formatting

Re: Windows Security Log Formatting

Re: Windows Security Log Formatting

Re: Windows Security Log Formatting

Re: Windows Security Log Formatting

Re: Windows Security Log Formatting

Re: Windows Security Log Formatting

Re: Windows Security Log Formatting

Re: Windows Security Log Formatting

Windows Security Log Formatting