I am trying to get the top 10 Failed Login count by User. The problem is that Windows 2008 uses "Account_Name" and Windows 2003 uses "User_Name" so I've used eval to combine the two fields but I am also using rex to go to the second instance of the Account_Name in the Windows 2008 event. The rex expression doesn't seem to work when I throw eval in there. Below is my search string, any suggestions?
source="WinEventLog:Security" EventCode="4625" OR EventCode="529" |eval USER=coalesce(Account_Name,User_Name) | rex "(?ms)Account For Which Logon Failed.+?Account Name:\s+(?
Solution:
source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex field=_raw max_match=99 "Account Name:\s+(?
yes, appears to have worked. Of course, as you can see the rex has been changed as well
So max=99 in rex command did it?
Sorry I miss-typed that last one, the correct search string is below. I get results however it is missing the "4625" events. Conversely, if I rename as User_Name it does not include the "529" events
source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex "(?ms)Account For Which Logon Failed.+?Account Name:s+(?
thank you for your reply, unfortunately putting |eval after rex did not work and using the rename function did not produce any results:
source="WinEventLog:Security" EventCode="4625" OR EventCode="529" | rex "(?ms)Account For Which Logon Failed.+?Account Name:s+(?
Does the rex work if you don't use eval? If yes then you can try moving eval after rex.
Another option you can try is to that instead of eval USER, use '|rename User_Name as Account_Name | ...| stats count by Account_Name'.