We have winEventLogs feeding into splunk.
I have the following alert setup.
sourcetype="WinEventLog:Security" interesting_event=yes group_type=protected | table Account_Name Group_Name message Security_ID
The problem that I am running into is that a single log contains three different values for the Security_ID field three separate times in the log. The first entry is the account making the change, the second is the account that was changed and the third is the group being modified.
I would like each of these to show up with appropriate labels. What I'm not sure about is how to select the X time the Security_ID field that shows up in a log in order to have it put in the table under a more descriptive label.
↧