Splunk Search

How to extract values from an event?

TB
New Member

Hi,

I am trying to create a table but how do I  extract these information in my query? I tried double quote " " but it's just looking for exact word. 

I want to list out like Subject: Account Name, then Logon Info

 

Subject:
	Security ID:		S-1
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		No

 

rmation: Logon Type: 3. I hope it makes sense. Thank you 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "Account Name:\s*(?<accountname>\S*)"
| rex "Logon Type:\s*(?<logontype>\S*)"
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...