I'm trying to perform a seemingly simple task, which is to search for failed logins in my AD environment. Here's the search I used found in another Answer;
Great! I found some failed logins. Now I want specific information out of this event which is the "Account Name" of the user who's having a problem. Ewwww, but with Microsoft's lovely log format, they so graciously supply TWO "Account Name" fields with the same name;
I want that second occurrence of "Account Name" (which holds username). Now you may already be thinking, hey buddy this question has been asked before -- go search because the answers out there (one, two) are to use "| eval newVar=mvindex(Account_Name,1)"...
...but hear me out. It's not behaving as expected.
So I adjust my search to store the 2nd occurrence of "Account Name" in a new variable and dump them into a table;
Here's the problem, this results in;
I can't get the value of the 2nd occurrence. Reading the documentation on Parse Fields With Multiple Values doesn't shed any light on my problem.
So I tried grabbing the last value; "newVar=mvindex(Account_Name,-1)" but that outputs blank as well. So I start to question if mvindex is doing anything... ...but the strange thing is that this "newVar=mvindex(Account_Name,0)" seems to store/retrieve just fine despite it not being the data I want.
Can someone point me in the right direction? Thanks in advance.
Running 4.1.5 Linux x86_64
How are you extracting the Account_Name field(s)?
answered 16 Nov '10, 23:23
An options is to extract the Account name after the ocurrence of "Account For Which Logon Failed":