Splunk Search

How to extract values from an event?

New Member


I am trying to create a table but how do I  extract these information in my query? I tried double quote " " but it's just looking for exact word. 

I want to list out like Subject: Account Name, then Logon Info


	Security ID:		S-1
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		No


rmation: Logon Type: 3. I hope it makes sense. Thank you 

Labels (1)
0 Karma

| rex "Account Name:\s*(?<accountname>\S*)"
| rex "Logon Type:\s*(?<logontype>\S*)"
0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...