- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Search for Windows logon events for usernames ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Search for Windows logon events for usernames matching a pattern with anomalousvalue Workstation Name
I want to start out with: EventIdentifier=4624 | AnomalousValue "Workstation Name"
...but this search returns an error. What am I doing wrong here? It's like Splunk doesn't know what the "Workstation Name" field is.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Based on your clarification, this should work:
EventIdentifier=4624 | anomalousvalue Workstation_Name
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Did this work?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Are you sure that it is a field? If it is, this will work, if not you need to make the field exist:
EventIdentifier=4624 | anomalousvalue $Workstation Name$
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It returned the field as Workstation_Name, but I've tried:
EventIdentifier=4624 | ...
- AnomalousValue 'Workstation_Name'
- AnomalousValue "Workstation_Name"
- AnomalousValue $Workstation_Name"
every single one of these returns "Error in 'anomalousvalue' command: found no qualifying results. Please verify that the field names are correct"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well that doesn't work so I guess it isn't a 'field'. This is annoying and confusing.
The event data has a section like this...
Network Information:
Workstation Name: TestClientPc
Source Network Address: 192.168.1.247
Source Port: 52404
So what the heck do I do here? Is this something I have to use eval() for?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Well obviously EventIdentifier is a field so some fields are being created. What do you get from this:
EventIdentifier=4624 | stats first(*)
This will show you what fields do exist. Perhaps this field is being extracted as Name instead of Workstation Name.
More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk
.conf24 | Personalize your .conf experience with Learning Paths!
Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...
