topic Re: Field extraction from a Windows log in Splunk Search

Field extraction from a Windows log

vagnet — Fri, 29 Oct 2021 13:16:17 GMT

Hi Splunkers,

I have prepared a regex extraction using regex101 site, and now trying to extract "Failure Reason" as per below log but for some reason fails.

Where is the catch? Should be pretty simple but I am out of ideas now.

Search:

| from datamodel:"Authentication"."Insecure_Authentication" | search "*Failure*" | rex "Failure\sReason:\t\t(?<Failure_Reason>.*)\n"

Log:

ComputerName=ot.mydomain.com TaskCategory=Logon OpCode=Info RecordNumber=41462650 Keywords=Audit Failure Message=An account failed to log on. Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: usergeorge$ Account Domain: dm Logon ID: 0x3E7 Logon Type: 8 Account For Which Logon Failed: Security ID: NULL SID Account Name: george1$ Account Domain: mydomain.com Failure Information: Failure Reason: Unknown user name or bad password. Status: 0xC000006D Sub Status: 0xC000006A Process Information: Caller Process ID: 0x2t20

Regards,

vagnet

Re: Field extraction from a Windows log

vhharanpositka — Fri, 29 Oct 2021 13:31:32 GMT

Hi Vagnet

You can try this @vagnet ,

| from datamodel:"Authentication"."Insecure_Authentication"
| search "*Failure*"
| rex field=_raw "Failure\sReason:\t\t(?<Failure_Reason>.*)\n"

Re: Field extraction from a Windows log

vagnet — Fri, 29 Oct 2021 14:00:54 GMT

Thanks @vhharanpositka . Same results though

Re: Field extraction from a Windows log

vhharanpositka — Fri, 29 Oct 2021 15:14:13 GMT

Hi @vagnet

This is working for me.

Re: Field extraction from a Windows log

vagnet — Fri, 29 Oct 2021 15:21:26 GMT

Thanks @vhharanpositka . It works using index searching, but when searching inside the datamodel. This is what I am trying to figure out.

Regards,

Vagnet

Re: Field extraction from a Windows log

vagnet — Fri, 29 Oct 2021 15:58:58 GMT

Hi,

The solution is to adjust the quotes on the data model. One easily missed I guess.

| from datamodel:"Authentication.Insecure_Authentication" | rex field=_raw "Failure\sReason:\t\t(?<Failure_Reason>.*)\s"

Regards,

Vagnet