topic Re: Using rex command to extract Message field in Windows Event Logs in Splunk Search

Using rex command to extract Message field in Windows Event Logs

Alfred — Thu, 06 May 2021 05:44:13 GMT

I want to extract from the Message field in the Windows Event Log just the first few words until the period - example would be:

Message=A user account was unlocked. Subject: Security ID: xxxxxxxxxxxxxxxx Account Name: xxxxxxxxxx Account Domain: xxxxxxxxx Logon ID: xxxxxxxxxx Target Account: Security ID: xxxxxxxxxxxxxx-xxxxxxxx Account Name: xxxxxxxxxx Account Domain: xxxxxxxxxx

Re: Using rex command to extract Message field in Windows Event Logs

aasabatini — Thu, 06 May 2021 06:44:34 GMT

Hi @Alfred

the best way to extract these fields is:

the key value automatic extraction

https://docs.splunk.com/Documentation/Splunk/8.1.3/Knowledge/Automatickey-valuefieldextractionsatsearch-time

anyway if you need a rex for other reason this is a good way to extract the message field

| rex field=_raw "(Message=(?<message>[a-zA-z ].*)Subject)"

Re: Using rex command to extract Message field in Windows Event Logs

Alfred — Thu, 06 May 2021 15:36:40 GMT

Thanks aasabatini ... my goal is as follows :

in the Message ( extracted) field I need to table only the first sentence instead of the whole message - your rex command seem to be correct but applying it did not change the Message output in the query , I still see the whole message

Re: Using rex command to extract Message field in Windows Event Logs

Alfred — Thu, 06 May 2021 16:40:11 GMT

I found an extraction created after running the rex command you sent - called "name " - I wonder if I can give a name to the rex extraction ... so I can call it in a table

Re: Using rex command to extract Message field in Windows Event Logs

aasabatini — Thu, 06 May 2021 18:49:11 GMT

Hi @Alfred

yes, you can use a table comand after the rex comand

| rex field=_raw "(Message=(?<message>[a-zA-z ].*)Subject)" | table message

rex comand can extract fields in search time

If you want define the extraction at index time you can put the regex expression on the props.conf file

Example

[your sourcetype] EXTRACT-message = (Message=(?<message>[a-zA-z ].*)Subject)

https://docs.splunk.com/Documentation/Splunk/8.1.3/Knowledge/Exampleconfigurationswithprops.conf

Re: Using rex command to extract Message field in Windows Event Logs

Alfred — Thu, 06 May 2021 21:23:10 GMT

That solved it - Thanks for all your help