Splunk Search

Locked/Unlocked

Michael_Schyma1
Contributor
rex field=_raw "Message=A user account was.*(?<accaction>.+?)\."

07/19/2012 11:32:19 AM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4740 EventType=0 Type=Information ComputerName=servername.domain.com TaskCategory=User Account Management OpCode=Info RecordNumber=2363332024 Keywords=Audit Success Message=A user account was locked out. Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: SERVERNAME$ Account Domain: COMPANYNAME Logon ID: 0x4e7 Account That Was Locked Out: Security ID: DOMAIN\ACCOUNT Account Name: ACCOUNT Additional Information: Caller Computer Name: COMPUTERNAME

All I am getting is the first and last letter. I want it to it to display locked or unlocked.

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Your regex uses greedy matching before the matching group. When you do .* the regex engine will try to match as much as possible. You can try this kind of stuff out with a regex testing tool such as regexpal (http://www.regexpal.com/ ) or RegExr (http://gskinner.com/RegExr/ ). You probably want something like this instead:

rex field=_raw "Message=A user account was (?<accaction>.+?)\."

Or, if you only want the "locked" word, not the "out", you could do

rex field=_raw "Message=A user account was (?<accaction>\S+)"

View solution in original post

0 Karma

Ayn
Legend

Your regex uses greedy matching before the matching group. When you do .* the regex engine will try to match as much as possible. You can try this kind of stuff out with a regex testing tool such as regexpal (http://www.regexpal.com/ ) or RegExr (http://gskinner.com/RegExr/ ). You probably want something like this instead:

rex field=_raw "Message=A user account was (?<accaction>.+?)\."

Or, if you only want the "locked" word, not the "out", you could do

rex field=_raw "Message=A user account was (?<accaction>\S+)"
0 Karma

rgcurry
Contributor

I concur, partilularly with RegEx Pal, great web site that I use often and have found it to be VERY helpful.

0 Karma

Michael_Schyma1
Contributor

Any suggestions?

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Enterprise 9.4: Features to Power Your Digital Resilience

Hey Splunky People! We are excited to share the latest updates in Splunk Enterprise 9.4. In this release we ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

SignalFlow: What? Why? How?

What is SignalFlow? Splunk Observability Cloud’s analytics engine, SignalFlow, opens up a world of in-depth ...