topic Re: Need help on regex in Splunk Search

Need help on regex

sekhar463 — Wed, 28 Sep 2022 10:28:45 GMT

Hai all,

Need help on to extract as new filed for user named after CORP\

Message=Task Scheduler started "{B9F5A32A-A340-49C1-B620-8C7A439CA849}" instance of the "\Microsoft\Office\OfficeTelemetryAgentFallBack" task for user "CORP\s-ks4"

Thanks

Re: Need help on regex

ITWhisperer — Wed, 28 Sep 2022 10:31:19 GMT

Try this

| rex "CORP\\\\(?<username>[\"]+)\""

Re: Need help on regex

gcusello — Wed, 28 Sep 2022 10:33:30 GMT

Hi @sekhar463,

please try this:

| rex field=Message "\"CORP\\s-(?<your_field>[^\"]+)"

that you can test at https://regex101.com/r/cer0xU/1

this regex could be different if instead of \s there's a space after CORP.

Ciao.

Giuseppe

Re: Need help on regex

sekhar463 — Wed, 28 Sep 2022 11:05:44 GMT

Thanks.

how to update if i want to extract after user key word the name which is present

for below example event

09/28/2022 06:00:00 AM LogName=Microsoft-Windows-TaskScheduler/Operational EventCode=100 EventType=4 ComputerName=USHOUSSUTL01V.corp.amvescap.net User=NOT_TRANSLATED Sid=S-1-5-21-789336058-1757981266-839522115-166804 SidType=0 SourceName=Microsoft-Windows-TaskScheduler Type=Information RecordNumber=8012022 Keywords=None TaskCategory=Task Started OpCode=Start Message=Task Scheduler started "{A1EB5D56-3AA0-4658-9D3D-D6642DA56541}" instance of the "\DatastoreUsgaeReport - VDI" task for user "CORP\USHOU-SVC-VMWare".

Re: Need help on regex

sekhar463 — Wed, 28 Sep 2022 11:12:21 GMT

hai for below example event the name need to extract after user key like

want to extract CORP\USHOU-SVC-VMWare

Re: Need help on regex

ITWhisperer — Wed, 28 Sep 2022 11:19:27 GMT

| rex "user\s\"(?<username>[^\"]+)\""

Re: Need help on regex

sekhar463 — Wed, 28 Sep 2022 11:22:00 GMT

Thanks

its not working while trying in regex101

Re: Need help on regex

ITWhisperer — Wed, 28 Sep 2022 11:24:32 GMT

https://regex101.com/r/AZOxz8/1