- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Splunkers,
I have prepared a regex extraction using regex101 site, and now trying to extract "Failure Reason" as per below log but for some reason fails.
Where is the catch? Should be pretty simple but I am out of ideas now.
Search:
| from datamodel:"Authentication"."Insecure_Authentication"
| search "*Failure*"
| rex "Failure\sReason:\t\t(?<Failure_Reason>.*)\n"
Log:
ComputerName=ot.mydomain.com
TaskCategory=Logon
OpCode=Info
RecordNumber=41462650
Keywords=Audit Failure
Message=An account failed to log on.
Subject:
Security ID: NT AUTHORITY\SYSTEM
Account Name: usergeorge$
Account Domain: dm
Logon ID: 0x3E7
Logon Type: 8
Account For Which Logon Failed:
Security ID: NULL SID
Account Name: george1$
Account Domain: mydomain.com
Failure Information:
Failure Reason: Unknown user name or bad password.
Status: 0xC000006D
Sub Status: 0xC000006A
Process Information:
Caller Process ID: 0x2t20
Regards,
vagnet
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
The solution is to adjust the quotes on the data model. One easily missed I guess.
| from datamodel:"Authentication.Insecure_Authentication"
| rex field=_raw "Failure\sReason:\t\t(?<Failure_Reason>.*)\s"
Regards,
Vagnet
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
The solution is to adjust the quotes on the data model. One easily missed I guess.
| from datamodel:"Authentication.Insecure_Authentication"
| rex field=_raw "Failure\sReason:\t\t(?<Failure_Reason>.*)\s"
Regards,
Vagnet
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

Hi Vagnet
You can try this @vagnet ,
| from datamodel:"Authentication"."Insecure_Authentication"
| search "*Failure*"
| rex field=_raw "Failure\sReason:\t\t(?<Failure_Reason>.*)\n"
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks @vhharanpositka . Same results though
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks @vhharanpositka . It works using index searching, but when searching inside the datamodel. This is what I am trying to figure out.
Regards,
Vagnet
