Hi, I'm struggling to get this extracted correctly so it's usable.
The raw data is presented as:
Privileges: SeSecurityPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeTakeOwnershipPrivilege
SeDebugPrivilege
SeSystemEnvironmentPrivilege
SeLoadDriverPrivilege
SeImpersonatePrivilege
SeAssignPrimaryTokenPrivilege
By default, only the first entry is assigned to the field eg:
"SeSecurityPrivilege"
I can extract the remaining lines into the field using the regex "Privileges:\t(?P(\w+\s+|\t\t\t\w+\s+)+)", which returns this:
"SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege"
Now what I need is to split each of these into the Privileges field as separate values.
These values are not a static number of entries, so Privileges could contain anything between 1 and 10 lines.
Any advice would be great as the docs and answers I've read don't seem to help this situation.
TIA
Steve
Give this a try
index=main EventCode="576" |rex field=_raw "Privileges:\t(?P<Privileges>(\w+\s+|\t\t\t\w+\s+)+)" | rex field=Privileges max_match=0 "(?<Privilege>\S+)\s+" | mvexpand Privilege
Thanks to everyone that has offered help. Much appreciated.
Hi cdstealer
Try to add this, after your field extraction.
main search | rex field=_raw ... | makemv delim=" " Privileges | mvexpand Privileges
Hope it helps.
Give this a try
index=main EventCode="576" |rex field=_raw "Privileges:\t(?P<Privileges>(\w+\s+|\t\t\t\w+\s+)+)" | rex field=Privileges max_match=0 "(?<Privilege>\S+)\s+" | mvexpand Privilege
Perfect! I think you've solved a couple of my past questions. So thank you very much again 🙂
Hi again, Now I'm struggling transferring the search into props/transforms. I'm probably missing something simple.
props.conf:
EXTRACT-Privileges = Privileges:\t(?P<Privileges>(\w+\s+|\t\t\t\w+\s+)+)
REPORT-fields = privilege
transforms.conf:
[privilege]
SOURCE_KEY = Privileges
REGEX = "(?<privilege>\S+)\s+)
REPEAT_MATCH = true
MV_ADD = true
So the new field that contains the extracted values is not happening.
Hello, did you manage to solve this ?
You have an extra "
in front of your REGEX
in transforms.conf
.
try :
your_base_search|rex field=_raw "Privileges:\t(?P<Privileges>(\w+\s+|\t\t\t\w+\s+)+)"| eval Privileges=split(field_name_extraction, " ")| mvexpand Privileges|...
Hi fdi01, Thanks. Unfortunately this does not change the output.
Steve
your rex |rex field=_raw "Privileges:\t(?P<Privileges>(\w+\s+|\t\t\t\w+\s+)+)"|
capture all results in Privileges field ???