Getting Data In

How can I create a Dashboard to display only those domain User Accounts for which the contents of a specific AD attribute has changed?

untieshoe
Path Finder

Specifically, if an AD user account attribute "employeeType" changes from "NULL" to "Contractor", how can I detect/filter for that? Ideally I'd make a Dashboard to display only the User Accounts for which that attribute changed from NULL to Contractor (or something other than NULL) over the previous week. I have Active Directory feeds already set up, so I already receive historical data (snapshots of AD) that contain the data I need (i.e. the 'before' value and 'after' value of the attribute).

0 Karma

untieshoe
Path Finder

It does not do that.
In fact, if I try only | where changedFrom!="01234567" then I end up with no results instead of the NULL results.
There are no spaces.

0 Karma

sundareshr
Legend

instead of .. | where changedFrom!="01234567" can you try .. | search changedFrom!="01234567".

0 Karma

untieshoe
Path Finder

That yields zero results.

0 Karma

untieshoe
Path Finder

I don't know how to upload a screen shot, but I did notice this:
The events for permutations 2 and 3 have the identical time stamps. Might this be a problem?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...