Extract an information from a field

[mikedavem]

Hi all,

I'm working on an extraction of information into a SQL Server log.
I've a field Message that looks like :

LogName=Security
SourceName=MSSQLSERVER$AUDIT
EventType=0
...
statement:Login failed for user 'toto'. Reason : Password did not match that for the login provided. [CLIENT: clientname]
...

I would like to extract the part into the bracket [CLIENT: XXXX]
How can I do that ?
Sorry I'm a new user of splunk.

Regards

David

[mikedavem]

Thanks rechteklebe, it's work.

I also learn how to generate a pattern with our instruction 🙂

Regards

[rechteklebe · Accepted solution]

Hi,

there are two ways:

1. Use the "Extract Fields" function in the dropdown on the left side (blue arrow).
   In the values type the name of your client, and you should get the pattern.
   In your search you can use the pattern with the rex command --> rex "PATTERN"

2. Try with --> rex "(?i)provided.\s[(?P[^]]+)"

[rechteklebe]

Sorry I was wrong:
this should be the correct rex command:

rex "(?i)CLIENT:(?P[^]]+)"