See if you have the following fields in your audit index: index=audit action=create_user You should see within the raw log the passwordState field and the value should be along the lines of force password change. You can just rex that field out with this | rex field=_raw "passwordState=(?<passwordState>[^\s]+)" Then all you need to do from there is just table the fields: | table _time, index, action, passwordState, * ... View more

There are a couple routes to go from here. My recommendation would be to create a lookup of the user accounts, this should include AD username, email address, first and last name, and/or some unique identifier of the user. This lookup can be manual or automated (recommend automating through ldap/AD integration with Splunk). Once the lookup is configured, integrate your log sources that will identify authentication activity (Windows, O365, VPN,etc). Validate the log sources are parsing the fields correctly and compliant to the CIM standards. Once validated, add those indexes of log sources into the Authentication datamodel, then use your SPL to identify your requested criteria. Example search below: |tstats `summariesonly` values(Authentication.app) as app values(Authentication.action) from datamodel=Authentication.Authentication where [inputlookup terminated_users.csv |fields user |rename user as Authentication.user] by _time, Authentication.src, Authentication.user |`drop_dm_object_name(Authentication)` ... View more

For the common default fields, you would not need to reference the dataset name. You can just use "values(sourcetype) as sourcetype". Same goes with _time, source, and host. ... View more

Yeah, I've been noticing negative look aheads in tstats are hit or miss. The workaround I have been using is to add the exclusions after the tstats statement, but additional if you are excluding private ranges, throw those into a lookup file and add a lookup definition to match the CIDR, then reference the lookup in the tstats where clause. | tstats `summariesonly` count(All_Traffic.dest_ip) AS ip_count count(All_Traffic.dest_port) AS port_count from datamodel=Network_Traffic.All_Traffic where NOT [inputlookup internal_ranges.csv | fields ip | rename ip as All_Traffic.dest] by All_Traffic.dest_ip, All_Traffic.dest_port, All_Traffic.src_ip |`drop_dm_object_name(All_Traffic)` Or you could try cleaning the performance without using the cidrmatch. The IN function can identify CIDR. | search NOT dest IN (10.0.0.0/8,172.16.0.0/12, 192.168.0.0/16) ... View more