topic Re: Regex from EventCode 7035 in Splunk Search

Regex from EventCode 7035

MrWh1t3 — Mon, 28 Sep 2020 11:59:07 GMT

I am trying to create a regex that will parse a portion of a sentence within a Windows Log event.

As an example, EventCode=7035 generates the following:

The Network Location Awareness (NLA) service was.....sent a start
The Network Connection service was....sent a stop
The HTTP service was....sent a start
The HTTP service was....sent a stop
etc...

What I would like to parse out is, just the information between "The" and "service" and also the words start or stop.

That way I can build a list of services there were started or stopped.

So far I have:

EventCode=7035 | dedup Message | rex field=Message "(?i)="The (.*?) service .*? (start|stop)"

It doesn't seem to be working like I want. I would like it to output into table format along with the ComputerName Extracted_Service_Name and whether or not it was started or stopped.

Thoughts on this?

Re: Regex from EventCode 7035

lguinn2 — Tue, 26 Jun 2012 04:41:41 GMT

Try this:

EventCode=7035 
| dedup Message 
| rex field=Message "The (?<Extracted_Service_Name>.*?) service was .*? sent a (?<Action>start|stop)"
| table ComputerName Extracted_Service_Name Action

Re: Regex from EventCode 7035

MrWh1t3 — Mon, 28 Sep 2020 11:59:10 GMT

It picks up a few "blank" Extracted_Service_Name, but I think this will be, ok. I really appreciate it. I also see where I was going wrong. Thanks a lot!!!

Re: Regex from EventCode 7035

lguinn2 — Tue, 26 Jun 2012 04:57:59 GMT

To get rid of the blanks,

But can you show an example of an event where it extracted blanks? I wonder if the regular expression could be better...

Re: Regex from EventCode 7035

lguinn2 — Tue, 26 Jun 2012 05:35:00 GMT

Another concern I have - what if a service was started and stopped several times within your search time range? Because you are de-duping the Message, you would only see one start and one stop. Is this what you want? It would also be possible to count the number of starts/stops if you didn't dedup...