I'm reviewing Microsoft Event Code 4656 (Failed Object Access) but when I try to audit Accesses or Access Reasons, Splunk will only return the first event in that field (In this situation it's DELETE). I'm trying to find a way to table all results to see everything in that field (i.e. Read Control, Write DAC, Synchronize, ReadData, WriteData too) Not just DELETE. I've tried mvindex, stats list(Accesses), stats values(Accesses)...but the results always return the first result. I was thinking maybe I have to write a regular expression to list everything between Accesses: to Access Reasons:, AND Access Reasons: to Access Masks: Any information you can provide me would be appreciated because right now I'm stuck. Index=winevents sourcetype=wineventlog:security EventCode=4656 | "this is where I'm stuck" | table user, host, Object_Name, Access_Reasons Accesses: DELETE READ_CONTROL WRITE_DAC SYNCHRONIZE ReadData (or ListDirectory) WriteData (or AddFile) ReadEA WriteEA ReadAttributes WriteAttributes Access Reasons: DELETE: Unknown or unchecked READ_CONTROL: Unknown or unchecked WRITE_DAC: Unknown or unchecked SYNCHRONIZE: Unknown or unchecked ReadData (or ListDirectory): Unknown or unchecked WriteData (or AddFile): Unknown or unchecked ReadEA: Unknown or unchecked WriteEA: Unknown or unchecked ReadAttributes: Unknown or unchecked WriteAttributes: Unknown or unchecked Access Mask: ... View more

example: If I have a list of user and I want to search and the users who only have a number in that field; John_doe John_doe1 Jane_doe Jane_doe2 How do I return just the users with numbers associated to their field? ... View more