Splunk Enterprise Security

Can you help me with the following regex expression?

tmwhitm
New Member

I have been reviewing answers from this forum & Splunk doc but I can't seem to find out why my rex command keeps throwing the error, "Error in 'rex' command: Encountered the following error while compiling the regex '(?<='Logon': Regex: missing closing parenthesis". My rex looks similar to others in this forum and works great on regex101 but I am obviously missing something. Here is my SPL,

source="wineventlog:Security" user=xxxxx (EventCode=4624 OR EventCode=4634)
| rex field=subject (?<=Logon ID:)(.*)(?=\b)
| eval Account_Name=mvindex(Account_Name,1)
| eval User=coalesce(Account_Name,Logon_Account,Logon_account,User_Name)
| eval User=lower(User)

Any guidance is appreciated.

Tom

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@tmwhitm

I have extracted Logon id and added where condition to filter events having Logon ID: 0x16cbfadd7

Can you please try this?

source="wineventlog:Security" user=xxxxx (EventCode=4624 OR EventCode=4634)
| rex field=_raw "Logon ID: (?<Logon_Id>.*)" 
| where Logon_Id="0x16cbfadd7"
| eval Account_Name=mvindex(Account_Name,1)
| eval User=coalesce(Account_Name,Logon_Account,Logon_account,User_Name)
| eval User=lower(User)

tmwhitm
New Member

That seemed to work very well. Thank you...

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Great
Can you please accept the answer and upvote my comment to help the community?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Can you please share a sample event which you are going to match??
meanwhile, you can try this.

| rex field=subject "(?<Logon_ID>:)(.*)(?=\b)"

0 Karma

tmwhitm
New Member

Your rex worked, no error but here is an example of the event. My other question if you would be so kind, I was under the impression that the rex command would change the content of the field name, 'subject' in this case to only contain the result of the rex command, "0x16cbfadd7" from the example below but it doesn't. Where am I wrong?

10/5/18
1:38:55.000 PM

10/05/2018 01:38:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=AD04.ad.net
TaskCategory=Logoff
OpCode=Info
RecordNumber=826696385
Keywords=Audit Success
Message=An account was logged off.

Subject:
Security ID: AD\xxxxxxx
Account Name: xxxxxxx
Account Domain: AD
Logon ID: 0x16cbfadd7

Logon Type: 3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.

0 Karma

Vijeta
Influencer

You need to escape the '\'with another \ . Try this

| rex field=subject (?<=Logon ID:)(.*)(?=\b)

0 Karma

tmwhitm
New Member

Hi Vijeta, this rex did not work, I received the same error message. I added an example of an event to the post above, that rex did work but I am still missing something with regards to the rex command.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!