Splunk Search

Locked/Unlocked

Michael_Schyma1
Contributor
rex field=_raw "Message=A user account was.*(?<accaction>.+?)\."

07/19/2012 11:32:19 AM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4740 EventType=0 Type=Information ComputerName=servername.domain.com TaskCategory=User Account Management OpCode=Info RecordNumber=2363332024 Keywords=Audit Success Message=A user account was locked out. Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: SERVERNAME$ Account Domain: COMPANYNAME Logon ID: 0x4e7 Account That Was Locked Out: Security ID: DOMAIN\ACCOUNT Account Name: ACCOUNT Additional Information: Caller Computer Name: COMPUTERNAME

All I am getting is the first and last letter. I want it to it to display locked or unlocked.

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Your regex uses greedy matching before the matching group. When you do .* the regex engine will try to match as much as possible. You can try this kind of stuff out with a regex testing tool such as regexpal (http://www.regexpal.com/ ) or RegExr (http://gskinner.com/RegExr/ ). You probably want something like this instead:

rex field=_raw "Message=A user account was (?<accaction>.+?)\."

Or, if you only want the "locked" word, not the "out", you could do

rex field=_raw "Message=A user account was (?<accaction>\S+)"

View solution in original post

0 Karma

Ayn
Legend

Your regex uses greedy matching before the matching group. When you do .* the regex engine will try to match as much as possible. You can try this kind of stuff out with a regex testing tool such as regexpal (http://www.regexpal.com/ ) or RegExr (http://gskinner.com/RegExr/ ). You probably want something like this instead:

rex field=_raw "Message=A user account was (?<accaction>.+?)\."

Or, if you only want the "locked" word, not the "out", you could do

rex field=_raw "Message=A user account was (?<accaction>\S+)"
0 Karma

rgcurry
Contributor

I concur, partilularly with RegEx Pal, great web site that I use often and have found it to be VERY helpful.

0 Karma

Michael_Schyma1
Contributor

Any suggestions?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...