Splunk Search

Extracting Fields & Regular Expression Formating

santorof
Path Finder

I have Active Directory logs that do not have many fields associated with them. Each log is over 100 lines and I wish to extract a lockoutTime field that is further down in the bottom of each log. When going to extract the field I cannot do the automatic method because it only shows me the first 15 to 20 lines. Is there a way to show the entire raw log to do an automatic scroll over extraction? If not how would I format the regular expression where my line is lockoutTime=0 and I want to extract lockoutTime to see all of the results for that field across my logs?

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Write your own regex to extract the field. Start with this

lockoutTime=(?<lockoutTime>\d+)
---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Write your own regex to extract the field. Start with this

lockoutTime=(?<lockoutTime>\d+)
---
If this reply helps you, Karma would be appreciated.

santorof
Path Finder

This works perfectly thank you.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...