I am trying to create a regex that will parse a portion of a sentence within a Windows Log event.
As an example, EventCode=7035 generates the following:
The Network Location Awareness (NLA) service was.....sent a start
The Network Connection service was....sent a stop
The HTTP service was....sent a start
The HTTP service was....sent a stop
etc...
What I would like to parse out is, just the information between "The" and "service" and also the words start or stop.
That way I can build a list of services there were started or stopped.
So far I have:
EventCode=7035 | dedup Message | rex field=Message "(?i)="The (.*?) service .*? (start|stop)"
It doesn't seem to be working like I want. I would like it to output into table format along with the ComputerName Extracted_Service_Name and whether or not it was started or stopped.
Thoughts on this?
Try this:
EventCode=7035
| dedup Message
| rex field=Message "The (?<Extracted_Service_Name>.*?) service was .*? sent a (?<Action>start|stop)"
| table ComputerName Extracted_Service_Name Action
Another concern I have - what if a service was started and stopped several times within your search time range? Because you are de-duping the Message, you would only see one start and one stop. Is this what you want? It would also be possible to count the number of starts/stops if you didn't dedup...
Try this:
EventCode=7035
| dedup Message
| rex field=Message "The (?<Extracted_Service_Name>.*?) service was .*? sent a (?<Action>start|stop)"
| table ComputerName Extracted_Service_Name Action
To get rid of the blanks,
EventCode=7035
| dedup Message
| rex field=Message "The (?<Extracted_Service_Name>.*?) service was .*? sent a (?<Action>start|stop)"
| where Extracted_Service_Name!=null()
| table ComputerName Extracted_Service_Name Action
But can you show an example of an event where it extracted blanks? I wonder if the regular expression could be better...
It picks up a few "blank" Extracted_Service_Name, but I think this will be, ok. I really appreciate it. I also see where I was going wrong. Thanks a lot!!!