https://community.splunk.com/t5/Getting-Data-In/How-to-parse-Microsoft-Windows-TaskScheduler-Operational-logs/m-p/369034#M67009 <P>This worked, thanks!</P> Thu, 23 Mar 2017 14:38:20 GMT kinkster 2017-03-23T14:38:20Z https://community.splunk.com/t5/Getting-Data-In/How-to-parse-Microsoft-Windows-TaskScheduler-Operational-logs/m-p/369032#M67007 <P>Can someone help me out with a regular expression to parse Microsoft-Windows-TaskScheduler/Operational logs? I don't think I am the first to want to extract fields from this log? I am pulling in the above logs. I tried renderxml=true and renderxml=false.</P> <P>I ran into this error below when trying to extract manually and the solution is to use my own regular expression.<BR /> The extraction failed. If you are extracting multiple fields, try removing one or more fields. Start with extractions that are embedded within longer text strings.</P> <P>An example of the line I am trying to extract values is: </P> <PRE><CODE>Message=Task Scheduler started "{CD0B4355-0A74-4D11-A816-04E3C5B138C5}" instance of the "\Adobe Flash Player Updater" task for user "contso\system301$" </CODE></PRE> <P>I want to extract "\Adobe Flash Player Updater" as TaskName and "contso\system301$" as TaskUser.</P> <P>Any help is appreciated. </P> Tue, 21 Mar 2017 21:57:37 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-parse-Microsoft-Windows-TaskScheduler-Operational-logs/m-p/369032#M67007 kinkster 2017-03-21T21:57:37Z https://community.splunk.com/t5/Getting-Data-In/How-to-parse-Microsoft-Windows-TaskScheduler-Operational-logs/m-p/369033#M67008 <P>Try this untested query.</P> <PRE><CODE>... | rex field=Message "(?&lt;TaskName&gt;\"[^\"]+\")\stask\sfor\suser\s(?&lt;TaskUser&gt;\"[^\"]+\")" | ... </CODE></PRE> Tue, 21 Mar 2017 22:32:23 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-parse-Microsoft-Windows-TaskScheduler-Operational-logs/m-p/369033#M67008 richgalloway 2017-03-21T22:32:23Z https://community.splunk.com/t5/Getting-Data-In/How-to-parse-Microsoft-Windows-TaskScheduler-Operational-logs/m-p/369034#M67009 <P>This worked, thanks!</P> Thu, 23 Mar 2017 14:38:20 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-parse-Microsoft-Windows-TaskScheduler-Operational-logs/m-p/369034#M67009 kinkster 2017-03-23T14:38:20Z https://community.splunk.com/t5/Getting-Data-In/How-to-parse-Microsoft-Windows-TaskScheduler-Operational-logs/m-p/369035#M67010 <P>Cool. Please accept the answer.</P> Thu, 23 Mar 2017 21:04:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-parse-Microsoft-Windows-TaskScheduler-Operational-logs/m-p/369035#M67010 richgalloway 2017-03-23T21:04:32Z