Locked/Unlocked

[Michael_Schyma1]

rex field=_raw "Message=A user account was.*(?<accaction>.+?)\."

07/19/2012 11:32:19 AM LogName=Security SourceName=Microsoft Windows security auditing. EventCode=4740 EventType=0 Type=Information ComputerName=servername.domain.com TaskCategory=User Account Management OpCode=Info RecordNumber=2363332024 Keywords=Audit Success Message=A user account was locked out. Subject: Security ID: NT AUTHORITY\SYSTEM Account Name: SERVERNAME$ Account Domain: COMPANYNAME Logon ID: 0x4e7 Account That Was Locked Out: Security ID: DOMAIN\ACCOUNT Account Name: ACCOUNT Additional Information: Caller Computer Name: COMPUTERNAME

All I am getting is the first and last letter. I want it to it to display locked or unlocked.

[Ayn · Accepted solution]

Your regex uses greedy matching before the matching group. When you do .* the regex engine will try to match as much as possible. You can try this kind of stuff out with a regex testing tool such as regexpal (http://www.regexpal.com/ ) or RegExr (http://gskinner.com/RegExr/ ). You probably want something like this instead:

rex field=_raw "Message=A user account was (?<accaction>.+?)\."

Or, if you only want the "locked" word, not the "out", you could do

rex field=_raw "Message=A user account was (?<accaction>\S+)"

[rgcurry]

I concur, partilularly with RegEx Pal, great web site that I use often and have found it to be VERY helpful.

[Michael_Schyma1]

Any suggestions?