Extracting Account Name:

[wkbevill]

Oct 28 20:08:57 XXX.XXX.com Microsoft-Windows-Security-Auditing[4]: EventID: 4663 An attempt was made to access an object. Subject: Security ID: XXX Account Name: John Account Domain: XXX 

My question is how do I extract the "Account Name: user" from this? I tried creating a new field extract with the space delimiter but if I selected John above, it wouldn't pull the account name from the rest of the log entries.

Thanks in advance!

[PickleRick · Accepted solution]

Well, delmited fields extractiona work well with... delimited fields. When you have very strict format of your data (like csv).

If you want to extracts parts of a "sentence", you need regex-based extraction.

You need to look for a repeatable part of event that you can "hook" into to find your needed value. In your case it will probably be the constant string "Account Name:" after which the actual username is provided. So you get (assuming that usernames don't contain spaces and symbols)

Account\sName:\s(?<username>\w+)

[nmohammed]

Try this - 

"Account\sName:\s(?P<account_name>.+)\sAccount Domain"