All Apps and Add-ons

How to configure additional extractions on the "Message" field based on EventCode for WindowsEvent?

junxianli
Explorer

Hi all,

I am trying to source a way to only perform a certain set of extractions on the "Message" field, when EventCode=4265 (e.g).

Anyone has any clue? I don't want to apply the extraction directly on each event, as it may cause performance issue.

0 Karma

aakwah
Builder

Hello,

you can do the following

index=windows_events EventCode=4265 | rex "your_regex"

you can use erex to help you in building regex as per the following

index=windows_events EventCode=4265 | erex Message examples="error,login"

Regards,
Ahmed

0 Karma

aakwah
Builder

Yes that can be done, run the query on search

index=windows_events EventCode=4265

Then at the bottom of Fields bar (on left down corner of web interface)
press Extract New Fields
select any sample event
click Next
mark 4265 # the value of Event code we want to add to the regex
a menu will appear, select Require, then Add Required Text
mark the part pf the message you want to extract
a menu will appear, select Extract, provide Field Name, then Add Extraction
click Next
validate results
save

The generated regex will be added to props.conf

Regards,
Ahmed

0 Karma

junxianli
Explorer

Any ways to perform it via props.conf, transforms.conf or other .confs, instead of doing it within the search string?

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...