- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Search for Windows logon events for usernames matc...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Search for Windows logon events for usernames matching a pattern with anomalousvalue Workstation Name
I want to start out with: EventIdentifier=4624 | AnomalousValue "Workstation Name"
...but this search returns an error. What am I doing wrong here? It's like Splunk doesn't know what the "Workstation Name" field is.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Based on your clarification, this should work:
EventIdentifier=4624 | anomalousvalue Workstation_Name
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did this work?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you sure that it is a field? If it is, this will work, if not you need to make the field exist:
EventIdentifier=4624 | anomalousvalue $Workstation Name$
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It returned the field as Workstation_Name, but I've tried:
EventIdentifier=4624 | ...
- AnomalousValue 'Workstation_Name'
- AnomalousValue "Workstation_Name"
- AnomalousValue $Workstation_Name"
every single one of these returns "Error in 'anomalousvalue' command: found no qualifying results. Please verify that the field names are correct"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well that doesn't work so I guess it isn't a 'field'. This is annoying and confusing.
The event data has a section like this...
Network Information:
Workstation Name: TestClientPc
Source Network Address: 192.168.1.247
Source Port: 52404
So what the heck do I do here? Is this something I have to use eval() for?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well obviously EventIdentifier is a field so some fields are being created. What do you get from this:
EventIdentifier=4624 | stats first(*)
This will show you what fields do exist. Perhaps this field is being extracted as Name instead of Workstation Name.
Splunk Custom Visualizations App End of Life
Introducing Splunk Enterprise 9.2
Adoption of RUM and APM at Splunk
