How to extract fields from windows security log?

andrewits — Wed, 05 Feb 2020 14:05:48 GMT

I am looking to extract fields from some windows security events. Much of the data I need ends up being in the "message" section of the log due to the way Windows logs are formatted.

See the example below...ideally, each of the fields highlighted in yellow would be it's own field.

Any ideas? Thank you!

Re: How to extract fields from windows security log?

gcusello — Wed, 05 Feb 2020 15:17:18 GMT

Hi @andrewits,
Spunk by itself extract all fields where there's = (e.g. EventCode=4723).
Timestamp is automatically extracted.
The other fields can be extracted using regexes.

As first thing, install on your Search Head Splunk TA_Windows ( https://splunkbase.splunk.com/app/742/ ) so you already have all the needed extractions; if you're not satisfied and you want more fields, use regexes, e.g. to exctract Account Name after Subject, use something like this (sorry if my logs are in italian!):

(?ms)Soggetto:.*Nome account:\s+(?<Account_Name>\w+)

that you can see at https://regex101.com/r/QD06Ok/1

Ciao.
Giuseppe

topic Re: How to extract fields from windows security log? in Splunk Search

How to extract fields from windows security log?

Re: How to extract fields from windows security log?