topic Re: rex expression in Splunk Search

rex expression

pil321 — Wed, 05 Oct 2016 20:24:36 GMT

I need to extract the account name from this snippet of a Windows security event log:

Account For Which Logon Failed:
    Security ID: NULL SID
    Account Name: Joe User
    Account Domain: Some.Domain

This is the expression I'm using:

rex "Failed:\s+.*\s+Account\sName:\s+(?<TargetAccount>\S+)\s"

Which gives me this result:

 TargetAccount
          Joe

How do I account for the white space to get the rest of the account name to show up in the result?

sundareshr — Wed, 05 Oct 2016 20:29:16 GMT

Try this

.... | rex "Name:\s(?<TargetAccount>[^\n\r]+)"

MuS — Wed, 05 Oct 2016 20:35:21 GMT

upvoted, because the regex is matching faster 😉

gcusello — Thu, 06 Oct 2016 07:47:20 GMT

modify your regex in this way

Failed:\s+.*\s+Account\sName:\s+(?<TargetAccount>.*)

verify it on https://regex101.com/
Bye.
Giuseppe