topic Re: Help with regex in Splunk Search

Help with regex

vrmandadi — Tue, 15 Jan 2019 21:19:25 GMT

Below is the sample event

01/15/2019 03:49:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4738
EventType=0
Type=Information
ComputerName=STM12R2DC003.abc.com
TaskCategory=User Account Management
OpCode=Info
RecordNumber=2309384837
Keywords=Audit Success
Message=A user account was changed.

Subject:
Security ID: COMPANY\KS3840
Account Name: KS3840
Account Domain: company
Logon ID: 0x94B1FF95

Target Account:
Security ID: COMPANY\BArandallAU8340
Account Name: BArandallAU8340
Account Domain: COMPANY

I am trying to extract the one highlighted an using the following regex which I made using regex.101.It is working in correctly in regex101 but when used the same regex it is throwing error Regex: unmatched closing parenthesis

Regex
(Target\sAccount\:\s+Security\sID\:\s*)COMPANY\\(?<ABC>[^ ]+)Account

In Splunk

|rex field=_raw "(Target\sAccount\:\s+Security\sID\:\s*)COMPANY\\(?<ABC>[^ ]+)Account"

output

BArandallAU8340

Re: Help with regex

skoelpin — Tue, 15 Jan 2019 21:27:42 GMT

You need to escape the parenthesis to avoid this error. You can use a backslash to do it before the parenthesis

Also, I don't see a field name for your regular expression. Try this instead, your field name will be CompanyName

COMPANY\*(?<CompanyName>\w+)

Re: Help with regex

vrmandadi — Tue, 15 Jan 2019 21:32:09 GMT

I named the field as ABC

Re: Help with regex

skoelpin — Tue, 15 Jan 2019 21:36:56 GMT

I see it now, regardless the Regex I posted is faster with less steps and should solve your problem

Re: Help with regex

vrmandadi — Tue, 15 Jan 2019 21:48:34 GMT

I tried yours but it did not extract anything.I am trying to extract only the second account name in the event which is BArandallAU8340

Security ID: COMPANY\BArandallAU8340
Account Name: BArandallAU8340
Account Domain: COMPANY

Re: Help with regex

vrmandadi — Tue, 15 Jan 2019 21:56:55 GMT

i FIGURED IT OUT

Target\sAccount:\s+Security\sID:\s*COMPANY.(?\w+)

Re: Help with regex

skoelpin — Tue, 15 Jan 2019 22:22:20 GMT

Did you modify your original sample data? It had a * in it previously and now it doesn't which explains why it didn't capture it. I see you have a working solution, please accept the answer to close it out

Re: Help with regex

skoelpin — Wed, 06 Feb 2019 20:41:38 GMT

@vrmandadi can you accept the answer to close this out?

Re: Help with regex

mydog8it — Fri, 08 Feb 2019 22:08:19 GMT

Without trying to modify your regex, does this help?

|rex field=_raw "((Target\sAccount\:\s+Security\sID\:\s*)COMPANY\\(?<ABC>[^ ]+)Account)"