Splunk Search

Locked/Unlocked

Michael_Schyma1
Contributor
rex field=_raw "Message=A user account was.*(?<accaction>.+?)\."

07/19/2012 11:32:19 AM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4740 EventType=0 Type=Information ComputerName=servername.domain.com TaskCategory=User Account Management OpCode=Info RecordNumber=2363332024 Keywords=Audit Success Message=A user account was locked out. Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: SERVERNAME$ Account Domain: COMPANYNAME Logon ID: 0x4e7 Account That Was Locked Out: Security ID: DOMAIN\ACCOUNT Account Name: ACCOUNT Additional Information: Caller Computer Name: COMPUTERNAME

All I am getting is the first and last letter. I want it to it to display locked or unlocked.

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Your regex uses greedy matching before the matching group. When you do .* the regex engine will try to match as much as possible. You can try this kind of stuff out with a regex testing tool such as regexpal (http://www.regexpal.com/ ) or RegExr (http://gskinner.com/RegExr/ ). You probably want something like this instead:

rex field=_raw "Message=A user account was (?<accaction>.+?)\."

Or, if you only want the "locked" word, not the "out", you could do

rex field=_raw "Message=A user account was (?<accaction>\S+)"

View solution in original post

0 Karma

Ayn
Legend

Your regex uses greedy matching before the matching group. When you do .* the regex engine will try to match as much as possible. You can try this kind of stuff out with a regex testing tool such as regexpal (http://www.regexpal.com/ ) or RegExr (http://gskinner.com/RegExr/ ). You probably want something like this instead:

rex field=_raw "Message=A user account was (?<accaction>.+?)\."

Or, if you only want the "locked" word, not the "out", you could do

rex field=_raw "Message=A user account was (?<accaction>\S+)"
0 Karma

rgcurry
Contributor

I concur, partilularly with RegEx Pal, great web site that I use often and have found it to be VERY helpful.

0 Karma

Michael_Schyma1
Contributor

Any suggestions?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...