If you are getting no output, I would recommend removing the lines of the search one by one from the end until you get output, so you can narrow down your troubleshooting to the problematic line. Do you get any output if you remove the last line: | stats dc values("modifiedUser") by Action "Actioned By"   ... View more

You can use below splunk to check locked out accounts   sourcetype="wineventlog" EventCode=4740 OR EventCode=644 |eval src_nt_host=if(isnull(src_nt_host),host,src_nt_host) |stats latest(_time) AS time latest(src_nt_host) AS host BY dest_nt_domain user |eval ltime=strftime(time,"%c") |table ltime,dest_nt_domain user host |rename ltime AS "Lockout Time",dest_nt_domain AS Domain,user AS "Account Locked Out", host AS "Workstation"   ... View more

To obtain help from volunteers, you will first need to post sample data (anonymize as needed) that can support your belief that the search should return output.  If the logic is not obvious, you also need to explain your logic between raw data and your expected output. ... View more

The SPL syntax looks good.  We need to see some sample events to know if the SPL is correct or not. One thing that will result in no output is if either the room_name or room_email field is null.  When that happens, the stats command cannot group results so it returns nothing. ... View more

Hi @risingflight143 , yes, as yu can read at https://www.splunk.com/en_us/download/universal-forwarder.html Ciao. Giuseppe   ... View more

That's not much to work with so this answer will be very high-level. 1) Check splunkd.log for why Splunk exited. 2) Fix the cause of the exit. 3) Restart Splunk. ... View more

HI @risingflight143, good for you, see next time! Ciao and happy splunking Giuseppe P.S.: Karma Points are appreciated by all the contributors 😉 ... View more

Please can you provide some sanitised events so we can see what you are dealing with? ... View more

lets say i have user1 for which i need to check who has modified, i have many groups so i cannot give them, will the below syntax work for me. index=index_name (EventCode=4728 OR EventCode=4729) earliest=-5m latest=now | rename user1 AS "Actioned By", user1_first AS "First Name" user1_last AS "Last Name" name as "Action Taken" | rex mode=sed field="Account_Name" "s/CN=//g" | rex mode=sed field="Account_Name" "s/cn=//g" | rex mode=sed field="Account_Name" "s/,OU.*//g" | rex mode=sed field="Account_Name" "s/\\//g" | table "Actioned By" "First Name" "Last Name" Account_Name "Action Taken" Group_Name Account_Domain _time | sort - _time ... View more

This is documented at https://docs.splunk.com/Documentation/Forwarder/7.3.3/Forwarder/UpgradetheWindowsuniversalforwarder. No reboot is needed. ... View more