https://community.splunk.com/t5/Alerting/How-do-I-parse-the-three-separate-values-for-the-Security-ID/m-p/249656#M4672 <P>Thank you! The piece that I was missing was "mvindex". Below is my corrected search string, just in case it will help anyone. </P> <P><CODE>sourcetype="WinEventLog:Security" | eval AdminAccount=mvindex(Security_ID, 0) | eval ModifiedAccount=mvindex(Security_ID, 1)| table ModifiedAccount Group_Name message AdminAccount</CODE></P> Tue, 24 Nov 2015 19:03:29 GMT saulverde 2015-11-24T19:03:29Z https://community.splunk.com/t5/Alerting/How-do-I-parse-the-three-separate-values-for-the-Security-ID/m-p/249654#M4670 <P>We have winEventLogs feeding into splunk.<BR /><BR /> I have the following alert setup. </P> <PRE><CODE>sourcetype="WinEventLog:Security" interesting_event=yes group_type=protected | table Account_Name Group_Name message Security_ID </CODE></PRE> <P>The problem that I am running into is that a single log contains three different values for the Security_ID field three separate times in the log. The first entry is the account making the change, the second is the account that was changed and the third is the group being modified. </P> <P>I would like each of these to show up with appropriate labels. What I'm not sure about is how to select the X time the Security_ID field that shows up in a log in order to have it put in the table under a more descriptive label. </P> Tue, 24 Nov 2015 17:30:03 GMT https://community.splunk.com/t5/Alerting/How-do-I-parse-the-three-separate-values-for-the-Security-ID/m-p/249654#M4670 saulverde 2015-11-24T17:30:03Z https://community.splunk.com/t5/Alerting/How-do-I-parse-the-three-separate-values-for-the-Security-ID/m-p/249655#M4671 <P>Hopefully, this will give you an idea</P> <PRE><CODE>* | head 1 | eval x="s=1, s=2, s=3" | rex max_match=0 field=x "s=(?&lt;sids&gt;\d)" | eval sid=mvindex(sids, 1) | table sid </CODE></PRE> Tue, 24 Nov 2015 17:58:51 GMT https://community.splunk.com/t5/Alerting/How-do-I-parse-the-three-separate-values-for-the-Security-ID/m-p/249655#M4671 sundareshr 2015-11-24T17:58:51Z https://community.splunk.com/t5/Alerting/How-do-I-parse-the-three-separate-values-for-the-Security-ID/m-p/249656#M4672 <P>Thank you! The piece that I was missing was "mvindex". Below is my corrected search string, just in case it will help anyone. </P> <P><CODE>sourcetype="WinEventLog:Security" | eval AdminAccount=mvindex(Security_ID, 0) | eval ModifiedAccount=mvindex(Security_ID, 1)| table ModifiedAccount Group_Name message AdminAccount</CODE></P> Tue, 24 Nov 2015 19:03:29 GMT https://community.splunk.com/t5/Alerting/How-do-I-parse-the-three-separate-values-for-the-Security-ID/m-p/249656#M4672 saulverde 2015-11-24T19:03:29Z