Query giving multiple results in the same field, how to parse?

[MacAllen]

Doing a query on AD events for adding users to groups.  There are 3 events, one for each type of group.  2 of them are very straight forward, account_name is the account, group_name is the group, easy peasy.  However, event 4756 shoves everything into the account_name field, so I get something like this:

Account_Name

my_username

CN=user_I_Added

Enterprise Admins

All of this is in 1 line.  Looking inside the event, I get this:

Subject:

Security ID: mysid

Account Name: my_username

Account Domain: my domain

Logon ID: 0xmyid

Member:

Security ID: hersid

Account Name: CN=her_username

Group:

Security ID: groupside

Account Name: Enterprise Admins

Account Domain: my_domain

I'd like to select on group_name, but for some reason Enterprise Admins is shoved into one of 3 Account_names in the same event.  Suggestions on parsing this?  "Moving" the name to group_name?

[yuanliu · Accepted solution]

Given the fixed data syntax and segment order, @livehybrid's approach should work.  I'd like to offer a different, more semantic approach that depend less than exact order and string.

| rex mode=sed "s/(.*\n)*Message=.*\n//"
| eval data = split(_raw, "

")
| mvexpand data
| rex field=data max_match=0 mode=sed "s/(.+): *(.+)\n/\"\1\":\"\2\",\n/g
  s/,\n([^\"]+): *(.+)/,\"\1\":\"\2\"}\n}/g
  s/(.+): */{\n\"\1\":{/"
| spath input=data
| stats values(*) as * by RecordNumber
| fields - data

The idea is to convert structured Message into JSON so it handles all embedded data. (The above is one of several possible ways of doing this.)

Using the same emulation @livehybrid provides, this is the output:

RecordNumber	ComputerName	EventCode	Group.Account Domain	Group.Account Name	Group.Security ID	Member.Account Name	Member.Security ID	Subject.Account Domain	Subject.Account Name	Subject.Logon ID	Subject.Security ID
1098888999	DC.ACME.COM	4756	my_domain	Enterprise Admins	groupside	CN=her_username	hersid	my domain	my_username	0xmyid	mysid

If space in field names such as "Group.Account Name" is a hindrance, they can be replaced with a printable character before or after.

Hope this helps.

[livehybrid]

Hi @MacAllen 

How about this?

| rex field=_raw max_match=10 "Account Name: (?<account_name>[^\n]+)"
| eval subject_name = mvindex(account_name,0)
| eval member_name   = mvindex(account_name,1)
| eval group_name    = mvindex(account_name,2)
| table subject_name member_name group_name

If your Account_names is already a multivalue field then you wont need to do the rex command, just pluck the relevant items from the mv field using mvindex. Full example below:

| windbag | head 1 | eval _raw="08/14/2025 01:21:15 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4756
EventType=0
Type=Information
ComputerName=DC.ACME.COM
TaskCategory=Security Group Management
OpCode=Info
RecordNumber=1098888999
Keywords=Audit Success
Message=A member was added to a security-enabled universal group.
Subject:
Security ID: mysid
Account Name: my_username
Account Domain: my domain
Logon ID: 0xmyid
 
Member:
Security ID: hersid
Account Name: CN=her_username
 
Group:
Security ID: groupside
Account Name: Enterprise Admins
Account Domain: my_domain
Additional Information:
Privileges: -"
| rex field=_raw max_match=10 "Account Name: (?<account_name>[^\n]+)"
| eval subject_name = mvindex(account_name,0)
| eval member_name   = mvindex(account_name,1)
| eval group_name    = mvindex(account_name,2)
| table subject_name member_name group_name

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing