Splunk Search

How do you use the rex command to filter Windows security events?

Explorer

Hi there,

I'm trying to extract some data from Windows security logs and filter the counted results.

This search doesn't work though — any help?

index=something (EventCode="4732" OR EventCode="4728" OR EventCode="4756") 
| rex "(?i)Subject:W\r\n\tSecurity ID:\t\t(?P<Subject>.+)"  
| rex "(?i)Member:\W\r\n\tSecurity  ID:\t\t(?P<Member>.+)" 
| rex "(?i)Group:\W\r\n\tSecurity ID:\t\t(?P<Group>.+)"
| search group_obj_id="*admin*" OR group_obj_id="*adm*" OR group_obj_id="*admn*"
| convert ctime(_time) AS time
| eval Group_and_time=Group+"--"+time
| stats values(Group_and_time) as "Group added and Time added" dc(Group) as group_count by Member
| where group_count>1
| rename group_count as "Group Count"
0 Karma
1 Solution

Motivator

First of all, your RegEx does not seem to work ... you have to make it multiline-matching, the case-instensitivity is not necessary. It can be eased down a bit as well. Next, line #5 is sort of redundant, as group_obj_id="*adm*" covers the other two selections as well. The rest seems to work fine - at leat in my test environment.

This does it for me:

index=something (EventCode="4732" OR EventCode="4728" OR EventCode="4756") 
| rex "(?im)Subject:[^:]+:\t*(?P<Subject>.+)\n" 
| rex "(?im)Member:[^:]+:\t*(?P<Member>.+)\n" 
| rex "(?im)Group:[^:]+:\t*(?P<Group>.+)\n" 
| search group_obj_id="*adm*"
| convert ctime(_time) AS time 
| eval Group_and_time=Group+"--"+time 
| stats values(Group_and_time) as "Group added and Time added" dc(Group) as group_count by Member 
| where group_count>1 
| rename group_count as "Group Count"

View solution in original post

0 Karma

Motivator

First of all, your RegEx does not seem to work ... you have to make it multiline-matching, the case-instensitivity is not necessary. It can be eased down a bit as well. Next, line #5 is sort of redundant, as group_obj_id="*adm*" covers the other two selections as well. The rest seems to work fine - at leat in my test environment.

This does it for me:

index=something (EventCode="4732" OR EventCode="4728" OR EventCode="4756") 
| rex "(?im)Subject:[^:]+:\t*(?P<Subject>.+)\n" 
| rex "(?im)Member:[^:]+:\t*(?P<Member>.+)\n" 
| rex "(?im)Group:[^:]+:\t*(?P<Group>.+)\n" 
| search group_obj_id="*adm*"
| convert ctime(_time) AS time 
| eval Group_and_time=Group+"--"+time 
| stats values(Group_and_time) as "Group added and Time added" dc(Group) as group_count by Member 
| where group_count>1 
| rename group_count as "Group Count"

View solution in original post

0 Karma

Explorer

Thanks again @DMohn 🙂

I'm getting results in the Events tab, however, I can't display any statistics out of it.
I'll try to cut some of the code and see whether anything changes...

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!