How do I parse the three separate values for the Security_ID field in WinEventLogs for accurate alerting?

[saulverde]

We have winEventLogs feeding into splunk.

I have the following alert setup.

sourcetype="WinEventLog:Security" interesting_event=yes group_type=protected | table Account_Name Group_Name message Security_ID

The problem that I am running into is that a single log contains three different values for the Security_ID field three separate times in the log. The first entry is the account making the change, the second is the account that was changed and the third is the group being modified.

I would like each of these to show up with appropriate labels. What I'm not sure about is how to select the X time the Security_ID field that shows up in a log in order to have it put in the table under a more descriptive label.

[sundareshr · Accepted solution]

Hopefully, this will give you an idea

* | head 1 | eval x="s=1, s=2, s=3" | rex max_match=0 field=x "s=(?<sids>\d)" | eval sid=mvindex(sids, 1) | table sid

[saulverde]

Thank you! The piece that I was missing was "mvindex". Below is my corrected search string, just in case it will help anyone.

sourcetype="WinEventLog:Security" | eval AdminAccount=mvindex(Security_ID, 0) | eval ModifiedAccount=mvindex(Security_ID, 1)| table ModifiedAccount Group_Name message AdminAccount