Splunk Enterprise Security

Using REX field Command How?

atulod1
New Member

06/02/2018 06:00:37 AM
LogName=Application
SourceName=MSSQLSERVER
EventCode=18456
EventType=0
Type=Information
ComputerName=pwchdstgdw01.camilo.net
User=NOT_TRANSLATED
Sid=S-1-5-21-825750147-1553096506-3895987836-639042
SidType=0
TaskCategory=Logon
OpCode=None
RecordNumber=1185644
Keywords=Audit Failure, Classic
Message=Login failed for user 'M-core\caadmin'. Reason: Failed to open the explicitly specified database 'SSCap'.
[CLIENT: 10.97.41.171]

0 Karma

niketn
Legend

@atulod1 please add more details on what you need to extract using rex. Based on the data seems like you are you are using Windows Event Viewer Logs which should be automatically extracted as fields in Splunk.

Also while posting question on Splunk Answers make sure you mask/anonymize any sensitive information like User Id, database, Computer Name etc.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...