About jovnice

jovnice · ‎02-09-2026

Thanks for your help. I will look into this further.

jovnice · ‎02-09-2026

I've been looking there, but I didn't see the issue I'm having, so I can't troubleshoot.

jovnice · ‎02-06-2026

Yes, I mean SE (Splunk Enterprise). Thanks for responding. I haven't tried the upgrade yet because I wasn't sure whether it would fix the kvstore database issue. I want to update once I know if it's working or if there is any documentation on the KVStore database.

jovnice · ‎02-05-2026

Thank you for the information. Is there any information on the KV store upgrade, or why it is not working?

jovnice · ‎02-05-2026

I would like to upgrade from 9.0.0 to 10.2.0 while keeping the same license. The license is Splunk Enterprise - No Enforcement. Also, my 9.0.0 is not working correctly. It states that I can't update the KV store, and I also get this error message: Could not load lookup=LOOKUP-splunk_security_essentials. Will an upgrade help with that?

jovnice · ‎11-20-2024

Thanks, I will work on that information.

jovnice · ‎11-20-2024

I agree, but how can I fix this?

jovnice · ‎11-20-2024

The Statistics show locked and unlocked accounts, but the raw data does not show the event codes 4740 for yes and no.

jovnice · ‎11-20-2024

As I looked into the information you asked me for, the eventcode is supposed to lock out event code 4740, and it stated yes for lockout if it locks out. And No, if it is not. But in the raw data. It seems like my lockout question, doesn't exist.

jovnice · ‎11-20-2024

Thank for the information

jovnice · ‎11-20-2024

Thanks for the information and explaining again what information you wanted. Here is the raw data you requested:

jovnice · ‎11-20-2024

Thanks so much for trying to help me. I agree with what you stated. Something is wrong. However. I did; I posted what was in the what was in the search. Then, I posted what was ingested from the logs. I'm not sure what more information you need from me.

jovnice · ‎11-20-2024

I understand you're not able to help. Thanks for your help anyway.

jovnice · ‎11-19-2024

It does show locked-out users as well as unlocked users. Honestly, I know who is locked out and who is not. I wish it would be stated yes when it is instead of no for everyone. But the real issue I have is. How can I know what computer is locked out or if it is off-site?

jovnice · ‎11-19-2024

_time user desc OU hostName lockout How is this for an example?

jovnice · ‎11-19-2024

That search shows some who are locked out and some people who log in to a device. It shows some of everything. I wish it would determine who is locked out instead of stating no for everything.

jovnice · ‎11-19-2024

index=* source="activedirectory" eventtype="ad-files" Event* These are the logs I have. They give me a lot of information. However, it is not the computer name that is getting locked out or if they are off-site.

jovnice · ‎11-19-2024

I have an employee who keeps getting locked out. I wanted to know how to put a script in to find out which device is getting locked out.

jovnice · ‎02-21-2024

I also try this for my search: source="WinEventLog:Application" OR WinEventLog:Security EventCode=* user=* Received this for a message: No results found. Try expanding the time range.

jovnice · ‎02-21-2024

Error in 'search' command: Unable to parse the search: Comparator '=' has an invalid term on the left hand side: "index-name">source. The search job has failed due to an error. You may be able view the job in the

jovnice · ‎02-21-2024

I keep getting an error message when I am attempting to this command * EventCode=* user=* WinEventLog:Application | eval src_nt_host=coalesce(src_nt_host,host) | eval lockout=if(EventCode==644 OR EventCode==4740 OR EventCode==4624,"Yes","No") | stats latest(_time) as time, latest(src_nt_host) as host, latest(lockout) as lockedout values(dest_nt_domain) as dest_nt_domain count(eval(EventCode=4625 OR EventCode=4771)) as count values(Source_Network_Address) as Source_Network_Address by user | eval time=strftime(time,"%c") | rename user to "User Name", Source_Network_Address to "IP Address", count to "Number of Failures" | table dest_nt_domain "User Name" host lockedout time "IP Address" "Number of Failures" I need to pull the application that are running in the event viewer. I was able to pull them in a different location, but I want it to say more information about with the user information.

jovnice · ‎02-02-2024

Thanks for the information. For the application I wanted to put an email alert on it for when someone is logging in and out of the application. Is that possible.

jovnice · ‎02-02-2024

I am very new to Splunk and having a hard time finding how to monitor applications. Can someone help?

Posts	23
Solutions	1
Karma Given	2
Karma Received	0
Member Since	‎01-26-2024

Online Status	Offline
Date Last Visited	‎02-17-2026 10:29 AM

Upgrade ES

Account keeps getting locked out

Need assistance with a command for application.

Applications

Re: Upgrade ES

Re: Upgrade ES

Re: Upgrade ES

Re: Upgrade ES

Upgrade ES

Re: Account keeps getting locked out

Re: Account keeps getting locked out

Re: Account keeps getting locked out

Re: Account keeps getting locked out

Re: Account keeps getting locked out

Re: Account keeps getting locked out

Re: Account keeps getting locked out

Re: Account keeps getting locked out

Re: Account keeps getting locked out

Re: Account keeps getting locked out

Re: Account keeps getting locked out

Re: Account keeps getting locked out

Account keeps getting locked out

Re: Need assistance with a command for application...

Re: Need assistance with a command for application...

Need assistance with a command for application.

Re: Applications

Applications

Join the Conversation