Splunk Search

Listonly desired accounts

noy72
New Member

Splunk Enterprise 7.1.3, SCCM Current Branch with univesal forwarder configured to forward event logs and WMI.

I have written the following query, with the goal of identifying whenever the status of a SCCM service account changes. It is working, but I want it to only display the accounts identified in the query (it is currently showing all account activity on the server) and, I would like to show zeros if there has been no activity as opposed to not showing an entry. I tried fillnull and several other recommendations in other questions with undesirable results.

index="wineventlog" source="wineventlog:security" (Account_Name="sccm.migrate" OR "configmgr.ssia" OR "configmgr.sql.ssrs" OR "configmgr.nac" NOT "SYSTEM") (Account_Name!="-") earliest=-30h@h latest=now | stats count by Account_Name | sort - count | rename Account_Name to "User Name", count to "Number of Entries"

Thank you for your time.
Ron Jones

0 Karma
1 Solution

vasanthmss
Motivator

Hi Ron,

Splunk search filter Inclusion is better than exclusion.

are ("sccm.migrate" OR "configmgr.ssia" OR "configmgr.sql.ssrs" OR "configmgr.nac") these are your account names? if so please mention the Account_Name=<value1> OR Account_Name=<value2>. (Account_Name!="-") is not require sine you are filtering the account names.

index="wineventlog" source="wineventlog:security" (Account_Name="sccm.migrate" OR Account_Name="configmgr.ssia" OR Account_Name="configmgr.sql.ssrs" OR Account_Name="configmgr.nac")   | stats count by Account_Name | sort - count | rename Account_Name to "User Name", count to "Number of Entries"

Hope this helps.

V

View solution in original post

vasanthmss
Motivator

Hi Ron,

Splunk search filter Inclusion is better than exclusion.

are ("sccm.migrate" OR "configmgr.ssia" OR "configmgr.sql.ssrs" OR "configmgr.nac") these are your account names? if so please mention the Account_Name=<value1> OR Account_Name=<value2>. (Account_Name!="-") is not require sine you are filtering the account names.

index="wineventlog" source="wineventlog:security" (Account_Name="sccm.migrate" OR Account_Name="configmgr.ssia" OR Account_Name="configmgr.sql.ssrs" OR Account_Name="configmgr.nac")   | stats count by Account_Name | sort - count | rename Account_Name to "User Name", count to "Number of Entries"

Hope this helps.

V

noy72
New Member

Thank you, @vasanthmss , I will try this first thing Tuesday morning.
Ron Jones

0 Karma

noy72
New Member

This worked great, except the "-" and "SYSTEM" entries came back. If filtering by != is not the best prctice, I'd apreciatesome guidance on what is.
Thank again
Ron Jones

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...