How to write this regex o get SecurityID value?

sbhatnagar88 — Thu, 24 Mar 2022 15:19:11 GMT

Can some one help me with Regex to get SecurityID value (in Bold) in Target Account. Below is sample.

**Event in Text form***

03/23/2022 03:20:16 PM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4738 EventType=0 Type=Information ComputerName=FRDPLIDC1.emea.loreal.intra TaskCategory=User Account Management OpCode=Info RecordNumber=386009504 Keywords=Audit Success Message=A user account was changed.

Subject: Security ID: EMEA\romain.pruneaux-adm Account Name: romain.pruneaux-adm Account Domain: EMEA Logon ID: 0x31BBDCF0

Target Account: Security ID: EMEA\frclichyloftvcL05.01 Account Name: frclichyloftvcL05.01 Account Domain: EMEA

Re: Need help with regex

ITWhisperer — Thu, 24 Mar 2022 10:16:43 GMT

Target Account:\s+Security ID:\s+(?<securityId>\S+)

Re: Need help with regex

sbhatnagar88 — Thu, 24 Mar 2022 10:24:43 GMT

@ITWhisperer - Thank you, didn't realize that was so simple..

topic Re: Need help with regex in Splunk Enterprise

How to write this regex o get SecurityID value?

Re: Need help with regex

Re: Need help with regex