Extract second instance of a field in multiple line log

[kevinshipley]

In the following log I want to extract the second instance of the "Security ID" field. I have tried a few different regex statements that I thought would work but have failed.

...
Message=A user account was locked out.

Subject:
    Security ID:        NT AUTHORITY\SYSTEM
    Account Name:       ComputerAccount$
    Account Domain:     MyDomain
    Logon ID:       0x3e7

Account That Was Locked Out:
    Security ID:        MyDomain\MyUser
    Account Name:       MyUser

Additional Information:
    Caller Computer Name:   SOMECOMPUTERNAME
...

I want to extact the Security ID that follows "Account That Was Locked Out:". Here is the regex I tried.

(?im)Account That Was Locked Out:\r\n\tSecurity ID:\t\t(?P-FIELDNAME-\w+\\\\w+)

Does anyone know how I might be able to achieve this?

[rcdalisay]

if this can help

"Account That Was Locked Out:\s+Security ID:\s+(?\S+)"

[Rob]

Perhaps you will want to give this regex a go...

| rex field=_raw "Account\sThat\sWas\sLocked\sOut:[\r\n]\s+Security\sID\:\s+(?<secID>\S+)

(Please remove ## before secID, the formatting is messing it up a bit.)

The reason that your original regex failed is because you tried using a carriage return and a new line as your anchor without making it a character group. This means that it was looking for both and not just one of them.

Please understand that the regex I posted above is very simple and can be tweaked quite a bit. If you want to be much more specific with it you can define only the characters you want instead non-space character as in my example (in case the domain name has spaces). Eg.

| rex field=_raw "Account\sThat\sWas\sLocked\sOut\:[\r\n]\s+Security\sID\:\s+(?<##secID>[\w\\\]+)"

[bmacias84]

I think I know what you are trying to accomplish. I’ve tested this and works with your sample data.

(?im)Account\sThat\sWas\sLocked\sOut:\s+Security\s+ID:\s+(?P<secID>[^\r\n]+)

I would recommend reading www.regular-expressions.info and purchasing Regex Buddy which is a great tool for testing regex statements.

Update options 2:

Using the search language this can also be accomplished. I'll break it down by segment.

First you have your base search which returns all your events.

index=main source="WinEventLog:Security"  |

Now if you event is mutli-valued and and the location is constant you can use mvcount and mvindex. mvcount will return the number of values stored in your mvfield. mvindex can return a single or subset of values in your mvfield.

where mvcount(Security_ID) = 2|  eval account=mvindex(Security_ID,1) | 

To verify your results use the fields or table command.

index=main source="WinEventLog:Security" | where mvcount(Security_ID) = 2|  eval account=mvindex(Security_ID,1) | table _time, Security_ID, account 

Don’t forget to accept or thumbs up answers if they help. Cheers

[bmacias84]

@kevinshipley, I updated my response with a search query that should meet your needs.

[bmacias84]

Ok, Have you tried to accomplish this in the search language? Since Splunk already extracts Security_ID, but in the case of your event its a multi-valued field. I would use the following search command mvcount and mvindex comminded with a where statement.

[kevinshipley]

Unfortunately your answer did not work either. I have used some tools to validate my regex and they all appear to be what I am looking for, however, they do not work within Splunk.