How to use eval mvindex in a search to pull values from the 2nd of two identical fields in an event?

[jbleich]

Hello fellow splunkers...

I am very new to splunk and currently what I'm trying to do is filter out windows event 4625 to see when my users are not getting their passwords correct. The event details comes up w/ 2 Account_Name's so I'm trying to use mvindex to omit the 1st one and only grab values in the second one. I'm going on the assumption that field 1 is actually 0 and field 2 is 1.....Here is the string I'm using.

EventCode=4625 | eval Account_Name=if(Account_Name="*$", (mvindex(Account_Name,1)), Account_Name)

Below is an example of the details in an event (Note: All computer names end in a $)
Subject:
Security ID: NULL SID
Account Name: -
Account Domain: -
Logon ID: 0x0
Logon Type: 3
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: ComputerName$
Account Domain:

[asimagu]

it may be that $ is a character that you need to escape... did you try that?

[jbleich]

I've also tried this search string which will work with any machine names individually, however if I try NOT Account_Name="*$" it doesnt work. I tried that because all machine names have the $ sign at the end.

EventCode=4625 NOT Account_Name="*$" | eval Account_Name =mvindex(Account_Name,1)

It's pulling the right account name field, but i cannot ommit the ones i dont want. If I replace the *$ with a specific machine name it will go ahead and take it out.