Splunk Dev

Will you help me extract rows which contain Remote Desktop Users or Administrators field names?

atyshke1
Path Finder

Hello,
Will you help me extract rows which contain Remote Desktop Users or Administrators field names?

"Server";"Local Group";"Name";"DisplayName";"Type";"Domain";"SID"
"server.peter.fd.com";"Remote Desktop Users";"S-1-5-21-1326131322-1829978501-250757269-1454717";"";"User";"EU1";"S-1-5-21-1326131322-1829978501-250757269-1454717"
"server.peter.fd.com";"";"$AT";"";"user";"domain";"S-1-5-21-1326131322-1829978501-250757269-1584230"
"server.peter.fd.com";"";"$OZ";"";"user";"domain";"S-1-5-21-1326131322-1829978501-250757269-1570766"
"server.peter.fd.com";"";"$TS";"";"user";"domain";"S-1-5-21-1326131322-1829978501-250757269-1505491"
"server.peter.fd.com";"";"$TH";"";"user";"domain";"S-1-5-21-1326131322-1829978501-250757269-1083479"
"server.peter.fd.com";"";"$SS";"";"user";"domain";"S-1-5-21-1326131322-1829978501-250757269-1528479"
Tags (1)
0 Karma
1 Solution

inventsekar
SplunkTrust
SplunkTrust

check this.. extracted approximately.. once you confirm/clearly update, then we can fine-tune the rex command..

sourcetype="test"
| rex field=_raw "\"(?<GroupName1>.*)\"\;\"Admin\"\;\"(?<GroupName2>.*[\"])\"\;\"" 
| table GroupName1 GroupName2 _raw

alt text

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

0 Karma

inventsekar
SplunkTrust
SplunkTrust

check this.. extracted approximately.. once you confirm/clearly update, then we can fine-tune the rex command..

sourcetype="test"
| rex field=_raw "\"(?<GroupName1>.*)\"\;\"Admin\"\;\"(?<GroupName2>.*[\"])\"\;\"" 
| table GroupName1 GroupName2 _raw

alt text

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

inventsekar
SplunkTrust
SplunkTrust

assuming each line as single event, maybe, check -
Yoursearch ("Remote Desktop Users" OR "Administrators") | table Server Local Group DisplayName Type

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

atyshke1
Path Finder

It's solution doesn't work

0 Karma

inventsekar
SplunkTrust
SplunkTrust

is every line is an event or the whole logs is a single event?
is the fields are already extracted?!?!
Yoursearch ("Local Group"="Remote Desktop Users" OR "Local Group"="Administrators") | table Server Local Group DisplayName Type

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

atyshke1
Path Finder

Whole logs is a single event with more rows
One log contains rows:

"server.peter.fd.com";"Remote Desktop Users";"S-1-5-21-1326131322-1829978501-250757269-1454717";"";"User";"EU1";"S-1-5-21-1326131322-1829978501-250757269-1454717"
"server.peter.fd.com";"";"$AT";"";"user";"domain";"S-1-5-21-1326131322-1829978501-250757269-1584230"
"server.peter.fd.com";"";"$OZ";"";"user";"domain";"S-1-5-21-1326131322-1829978501-250757269-1570766"
"server.peter.fd.com";"";"$TS";"";"user";"domain";"S-1-5-21-1326131322-1829978501-250757269-1505491"
"server.peter.fd.com";"";"$TH";"";"user";"domain";"S-1-5-21-1326131322-1829978501-250757269-1083479"
"server.peter.fd.com";"";"$SS";"";"user";"domain";"S-1-5-21-1326131322-1829978501-250757269-1528479"

0 Karma

inventsekar
SplunkTrust
SplunkTrust

ok, if the whole logs are a single event, then, you just like to "print" the lines or you want to do some other calculations?!?!
if just printing means, you can do some rex commands..
update us more info..

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

atyshke1
Path Finder

Yeah,
you are right. I need use rex command for create a table or stats count
I tried this command:

index="srgp_members" host="*" | rex max_match=0 field=_raw "(?<GroupName1>\S+)Administrators(?<GroupName2>\S+)" | table GroupName1, GroupName2

But it seems it's incorrect work

0 Karma

inventsekar
SplunkTrust
SplunkTrust

write your SPL query inside backticks (and) , so the full SPL command will be shown clearly

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma

atyshke1
Path Finder

I did it. CHeck please now

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...