How do I extract specific fields?

[klaudiac]

Hi folks, 

Hoping you might be able to help. 

I've some raw logs coming in and one of the "extracted" fields is a fields with all the system information I need e.g.

Remote Desktop Protocol: OS: Windows 10/Windows Server OS Build: 10.0.18362 Target Name: NACORP NetBIOS Domain Name: NACORP NetBIOS Computer Name: 1234ABC DNS Domain Name: na.corp.xxxxx.com System Time: 2021-12-12 22:55:40.534959 Authorized Use Only - v 041001 This system is for the use of authorized users only. 

How do I extract specific pieces from it? 
I need NetBIOS Domain Name and Computer Name and System Time

I thought of using a regex but not sure how to build it since NetBIOS Domain Name values can be of different variations e'g one will be NACORP another one will be USON and another wil be NACORP.LOCAL 

Similar with the computer name - there's no unified naming convention - it depends on a country we get the logs from. some can have a "-" in the middle, some will have a "." etc.

Any hints and tips on how to tackle it will be more than appreciated!

[richgalloway]

The rex command can do that.  I prefer to use separate commands in case the data should be in a different order.  In the case of domain and computer names, the regex doesn't care about naming conventions - it just takes everything up to the next space.  We can't do the same with System Time since it has an embedded space.

| rex field=foo "NetBIOS Domain Name: (?<NDN>\S+)"
| rex field=foo "NetBIOS Computer Name: (?<NCN>\S+)"
| rex field=foo "System Time: (?<sysTime>\d+-\d+-\d+ \d+:\d+:\d+\.\d+)"