Splunk Search

How to extract Target Account Name or Subject Account Name Security ID field from Windows Security Log?

erictodor
New Member

I'm searching on Windows Security Auditing logs and the Security_ID field but when I do, I'm realizing that there is a section for Subject and Target Account. I want to be able to extract each into its own unique field so I can search on one or the other. Here's a sample event log. Right now, both account_1 and account_2 would be in a field called Security_ID and I need to split the two. Thanks!

LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4738
EventType=0
Type=Information
ComputerName=server.domain.com
TaskCategory=User Account Management
OpCode=Info
RecordNumber=00000000
Keywords=Audit Success
Message=A user account was changed.

    Subject:
        Security ID:        DOMAIN\account_1
        Account Name:       account_1
        Account Domain:     DOMAIN
        Logon ID:       0000000

    Target Account:
        Security ID:        DOMAIN\account_2
        Account Name:       account_2
        Account Domain:     DOMAIN
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi erictodor,
you have to use a multi line regex, something like this:

(?ms)Target Account:.*Security ID:\s+(?<Security_ID>[^ ]*)

you can test it at https://regex101.com/r/ZGJi2D/1

Bye.
Giuseppe

View solution in original post

jtitus3
Explorer

|eval name1=mvindex(Account_Name,0)
|eval name2=mvindex(Account_Name,1)

gcusello
SplunkTrust
SplunkTrust

Hi erictodor,
you have to use a multi line regex, something like this:

(?ms)Target Account:.*Security ID:\s+(?<Security_ID>[^ ]*)

you can test it at https://regex101.com/r/ZGJi2D/1

Bye.
Giuseppe

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...