topic Re: Extracting information via Regex in Splunk Search

Extracting information via Regex

Michael_Schyma1 — Thu, 11 Oct 2012 12:22:00 GMT

Subject:

    Security ID:        NULL SID

    Account Name:       -

    Account Domain:     -

    Logon ID:       0x0



Logon Type:         3



Account For Which Logon Failed:

    Security ID:        NULL SID

    Account Name:       MIF3VB0

    Account Domain:     Company

I want to be able to create a regular expression that just grabs the second Account Name In my search under the title account for which logon failed. Does anyone have any suggestions on how i would go about extracting a variable with two values set to it. I am having many problems trying to figure this out. thank you so much

Re: Extracting information via Regex

Ayn — Thu, 11 Oct 2012 12:28:57 GMT

(?msi)Account For Which Logon Failed:.+?Account Name:\s+(\S+)

Re: Extracting information via Regex

Michael_Schyma1 — Thu, 11 Oct 2012 13:14:20 GMT

Thank you so much, that works perfectly. I got this to work but it doesnt look as good as yours:

rex field=_raw "Account For Which Logon Failed:\W\s+\w+\W\S+\W\W+\S+\W\S+\W\s+\w+\W\w+:\W\W(?.+?)\W"