Archive

Will you help me extract rows which contain Remote Desktop Users or Administrators field names?

Path Finder

Hello,
Will you help me extract rows which contain Remote Desktop Users or Administrators field names?

"Server";"Local Group";"Name";"DisplayName";"Type";"Domain";"SID"
"server.peter.fd.com";"Remote Desktop Users";"S-1-5-21-1326131322-1829978501-250757269-1454717";"";"User";"EU1";"S-1-5-21-1326131322-1829978501-250757269-1454717"
"server.peter.fd.com";"";"$AT";"";"user";"domain";"S-1-5-21-1326131322-1829978501-250757269-1584230"
"server.peter.fd.com";"";"$OZ";"";"user";"domain";"S-1-5-21-1326131322-1829978501-250757269-1570766"
"server.peter.fd.com";"";"$TS";"";"user";"domain";"S-1-5-21-1326131322-1829978501-250757269-1505491"
"server.peter.fd.com";"";"$TH";"";"user";"domain";"S-1-5-21-1326131322-1829978501-250757269-1083479"
"server.peter.fd.com";"";"$SS";"";"user";"domain";"S-1-5-21-1326131322-1829978501-250757269-1528479"
Tags (1)
0 Karma
1 Solution

Champion

check this.. extracted approximately.. once you confirm/clearly update, then we can fine-tune the rex command..

sourcetype="test"
| rex field=_raw "\"(?<GroupName1>.*)\"\;\"Admin\"\;\"(?<GroupName2>.*[\"])\"\;\"" 
| table GroupName1 GroupName2 _raw

alt text

View solution in original post

0 Karma

Champion

check this.. extracted approximately.. once you confirm/clearly update, then we can fine-tune the rex command..

sourcetype="test"
| rex field=_raw "\"(?<GroupName1>.*)\"\;\"Admin\"\;\"(?<GroupName2>.*[\"])\"\;\"" 
| table GroupName1 GroupName2 _raw

alt text

View solution in original post

0 Karma

Champion

assuming each line as single event, maybe, check -
Yoursearch ("Remote Desktop Users" OR "Administrators") | table Server Local Group DisplayName Type

0 Karma

Path Finder

It's solution doesn't work

0 Karma

Champion

is every line is an event or the whole logs is a single event?
is the fields are already extracted?!?!
Yoursearch ("Local Group"="Remote Desktop Users" OR "Local Group"="Administrators") | table Server Local Group DisplayName Type

0 Karma

Path Finder

Whole logs is a single event with more rows
One log contains rows:

"server.peter.fd.com";"Remote Desktop Users";"S-1-5-21-1326131322-1829978501-250757269-1454717";"";"User";"EU1";"S-1-5-21-1326131322-1829978501-250757269-1454717"
"server.peter.fd.com";"";"$AT";"";"user";"domain";"S-1-5-21-1326131322-1829978501-250757269-1584230"
"server.peter.fd.com";"";"$OZ";"";"user";"domain";"S-1-5-21-1326131322-1829978501-250757269-1570766"
"server.peter.fd.com";"";"$TS";"";"user";"domain";"S-1-5-21-1326131322-1829978501-250757269-1505491"
"server.peter.fd.com";"";"$TH";"";"user";"domain";"S-1-5-21-1326131322-1829978501-250757269-1083479"
"server.peter.fd.com";"";"$SS";"";"user";"domain";"S-1-5-21-1326131322-1829978501-250757269-1528479"

0 Karma

Champion

ok, if the whole logs are a single event, then, you just like to "print" the lines or you want to do some other calculations?!?!
if just printing means, you can do some rex commands..
update us more info..

0 Karma

Path Finder

Yeah,
you are right. I need use rex command for create a table or stats count
I tried this command:

index="srgp_members" host="*" | rex max_match=0 field=_raw "(?<GroupName1>\S+)Administrators(?<GroupName2>\S+)" | table GroupName1, GroupName2

But it seems it's incorrect work

0 Karma

Champion

write your SPL query inside backticks (and) , so the full SPL command will be shown clearly

0 Karma

Path Finder

I did it. CHeck please now

0 Karma