more regex help :/

tkerr1357 — Wed, 17 Feb 2021 17:33:33 GMT

Hey All,

I am trying to pull the username from the following event which is everything after the Rightnetworks\ in the event. Also to complicate things It could be a name or a set of numbers or a name with numbers in it. Any help is apperciated.

here are some example events:

02/17/2021 11:45:19 AM LogName=Microsoft-Windows-TerminalServices-LocalSessionManager/Operational SourceName=Microsoft-Windows-TerminalServices-LocalSessionManager EventCode=25 EventType=4 Type=Information ComputerName=BPSQCP03S11.rightnetworks.com User=NOT_TRANSLATED Sid=S-1-5-18 SidType=0 TaskCategory=None OpCode=Info RecordNumber=1079076 Keywords=None Message=Remote Desktop Services: Session reconnection succeeded: User: RIGHTNETWORKS\465714 Session ID: 350 Source Network Address: 184.97.224.236

02/17/2021 11:45:18 AM LogName=Microsoft-Windows-TerminalServices-LocalSessionManager/Operational SourceName=Microsoft-Windows-TerminalServices-LocalSessionManager EventCode=25 EventType=4 Type=Information ComputerName=RNVSASP217.rightnetworks.com User=NOT_TRANSLATED Sid=S-1-5-18 SidType=0 TaskCategory=None OpCode=Info RecordNumber=1064633 Keywords=None Message=Remote Desktop Services: Session reconnection succeeded: User: RIGHTNETWORKS\veronicagutierrez Session ID: 342 Source Network Address: 216.67.212.82

Re: more regex help :/

scelikok — Wed, 17 Feb 2021 18:38:02 GMT

Hi @tkerr1357,

Please try this;

| rex "User:\sRIGHTNETWORKS\\(?<username>[^\s]+)"

Re: more regex help :/

tkerr1357 — Thu, 18 Feb 2021 00:39:06 GMT

no such luck with this one.

Re: more regex help :/

scelikok — Thu, 18 Feb 2021 04:44:00 GMT

What is the problem? It is working for your sample events. Please see on Regex101.

https://regex101.com/r/xlvrf1/1

Re: more regex help :/

tkerr1357 — Thu, 18 Feb 2021 12:49:01 GMT

looks like it was an issue with my search. I was able to add the regex provided as a field extraction and that provided what I was looking for.

topic Re: more regex help :/ in Splunk Search

more regex help :/

Re: more regex help :/

Re: more regex help :/

Re: more regex help :/

Re: more regex help :/