Oct 28 20:08:57 XXX.XXX.com Microsoft-Windows-Security-Auditing[4]: EventID: 4663 An attempt was made to access an object. Subject: Security ID: XXX Account Name: John Account Domain: XXX
My question is how do I extract the "Account Name: user" from this? I tried creating a new field extract with the space delimiter but if I selected John above, it wouldn't pull the account name from the rest of the log entries.
Thanks in advance!
Well, delmited fields extractiona work well with... delimited fields. When you have very strict format of your data (like csv).
If you want to extracts parts of a "sentence", you need regex-based extraction.
You need to look for a repeatable part of event that you can "hook" into to find your needed value. In your case it will probably be the constant string "Account Name:" after which the actual username is provided. So you get (assuming that usernames don't contain spaces and symbols)
Account\sName:\s(?<username>\w+)
Well, delmited fields extractiona work well with... delimited fields. When you have very strict format of your data (like csv).
If you want to extracts parts of a "sentence", you need regex-based extraction.
You need to look for a repeatable part of event that you can "hook" into to find your needed value. In your case it will probably be the constant string "Account Name:" after which the actual username is provided. So you get (assuming that usernames don't contain spaces and symbols)
Account\sName:\s(?<username>\w+)
Try this -
"Account\sName:\s(?P<account_name>.+)\sAccount Domain"