topic Re: Query giving multiple results in the same field, how to parse? in Splunk Search

Query giving multiple results in the same field, how to parse?

MacAllen — Thu, 14 Aug 2025 20:04:09 GMT

Doing a query on AD events for adding users to groups. There are 3 events, one for each type of group. 2 of them are very straight forward, account_name is the account, group_name is the group, easy peasy. However, event 4756 shoves everything into the account_name field, so I get something like this:

Account_Name

my_username

CN=user_I_Added

Enterprise Admins

All of this is in 1 line. Looking inside the event, I get this:

Subject:

Security ID: mysid

Account Name: my_username

Account Domain: my domain

Logon ID: 0xmyid

Member:

Security ID: hersid

Account Name: CN=her_username

Group:

Security ID: groupside

Account Name: Enterprise Admins

Account Domain: my_domain

I'd like to select on group_name, but for some reason Enterprise Admins is shoved into one of 3 Account_names in the same event. Suggestions on parsing this? "Moving" the name to group_name?

Re: Query giving multiple results in the same field, how to parse?

livehybrid — Thu, 14 Aug 2025 22:00:16 GMT

Hi @MacAllen

How about this?

| rex field=_raw max_match=10 "Account Name: (?<account_name>[^\n]+)" | eval subject_name = mvindex(account_name,0) | eval member_name = mvindex(account_name,1) | eval group_name = mvindex(account_name,2) | table subject_name member_name group_name

livehybrid_0-1755208760825.png

If your Account_names is already a multivalue field then you wont need to do the rex command, just pluck the relevant items from the mv field using mvindex. Full example below:

| windbag | head 1 | eval _raw="08/14/2025 01:21:15 PM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4756 EventType=0 Type=Information ComputerName=DC.ACME.COM TaskCategory=Security Group Management OpCode=Info RecordNumber=1098888999 Keywords=Audit Success Message=A member was added to a security-enabled universal group. Subject: Security ID: mysid Account Name: my_username Account Domain: my domain Logon ID: 0xmyid Member: Security ID: hersid Account Name: CN=her_username Group: Security ID: groupside Account Name: Enterprise Admins Account Domain: my_domain Additional Information: Privileges: -" | rex field=_raw max_match=10 "Account Name: (?<account_name>[^\n]+)" | eval subject_name = mvindex(account_name,0) | eval member_name = mvindex(account_name,1) | eval group_name = mvindex(account_name,2) | table subject_name member_name group_name

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: Query giving multiple results in the same field, how to parse?

yuanliu — Fri, 15 Aug 2025 07:00:14 GMT

Given the fixed data syntax and segment order, @livehybrid's approach should work. I'd like to offer a different, more semantic approach that depend less than exact order and string.

| rex mode=sed "s/(.*\n)*Message=.*\n//" | eval data = split(_raw, " ") | mvexpand data | rex field=data max_match=0 mode=sed "s/(.+): *(.+)\n/\"\1\":\"\2\",\n/g s/,\n([^\"]+): *(.+)/,\"\1\":\"\2\"}\n}/g s/(.+): */{\n\"\1\":{/" | spath input=data | stats values(*) as * by RecordNumber | fields - data

The idea is to convert structured Message into JSON so it handles all embedded data. (The above is one of several possible ways of doing this.)

Using the same emulation @livehybrid provides, this is the output:

RecordNumber	ComputerName	EventCode	Group.Account Domain	Group.Account Name	Group.Security ID	Member.Account Name	Member.Security ID	Subject.Account Domain	Subject.Account Name	Subject.Logon ID	Subject.Security ID
1098888999	DC.ACME.COM	4756	my_domain	Enterprise Admins	groupside	CN=her_username	hersid	my domain	my_username	0xmyid	mysid

If space in field names such as "Group.Account Name" is a hindrance, they can be replaced with a printable character before or after.

Hope this helps.