REGEX help .. I am still learning ....

[Stephen11]

To all:

Still learning about REGEX ...  I looked at RUBULAR.COM and REFEX101.com to figure out how to pull out the Users ids...   In the example below need to get 4 User Ids out ...   I matched on single quote ' - however not able to get  the 4 ids in one swoop ... any suggestions?  Its just not that easy... 

Watched a couple of Youtubes on regex ... just not that all intuitive when condition are a little bit more tricky. appreciate any help I can get.

Multiple 'access denied' events detected with protocol smb (at least 41 failed attempts in 15 seconds). Last usernames used in login requests are: 'NA\HXXX6LBDBMCXT2$', 'NA\RKXXXEDE', 'UPSTREAM\dXXXcline', 'ULAB\l3xxxxcli'. Last path trying to access FA Labs\XXXM\Lumisizer\08-xx-2020_1201 A-D, 1201 A2-D2 - Copy\1201 C.xlsx

[isoutamo · Accepted solution]

Hi

With your example this seems to work.

index=_internal
| head 1
| eval _raw = "Multiple 'access denied' events detected with protocol smb (at least 41 failed attempts in 15 seconds). Last usernames used in login requests are: 'NA\HXXX6LBDBMCXT2$', 'NA\RKXXXEDE', 'UPSTREAM\dXXXcline', 'ULAB\l3xxxxcli'. Last path trying to access FA Labs\XXXM\Lumisizer\08-xx-2020_1201 A-D, 1201 A2-D2 - Copy\1201 C.xlsx"
| rename COMMENT AS "previous set example data, next do the regex"
| rex max_match=0  "Last usernames used in login requests are:\s(?<NamesAll>[^\.]+)"
| rex max_match=0 field=NamesAll "([',\s\.])+(?<Names>[^']+)"

r. Ismo 

[thambisetty]

Can you share sample event?

the example you shared is not clear.