Regex from EventCode 7035

[MrWh1t3]

I am trying to create a regex that will parse a portion of a sentence within a Windows Log event.

As an example, EventCode=7035 generates the following:

The Network Location Awareness (NLA) service was.....sent a start
The Network Connection service was....sent a stop
The HTTP service was....sent a start
The HTTP service was....sent a stop
etc...

What I would like to parse out is, just the information between "The" and "service" and also the words start or stop.

That way I can build a list of services there were started or stopped.

So far I have:

EventCode=7035 | dedup Message | rex field=Message "(?i)="The (.*?) service .*? (start|stop)"

It doesn't seem to be working like I want. I would like it to output into table format along with the ComputerName Extracted_Service_Name and whether or not it was started or stopped.

Thoughts on this?

[lguinn2]

Another concern I have - what if a service was started and stopped several times within your search time range? Because you are de-duping the Message, you would only see one start and one stop. Is this what you want? It would also be possible to count the number of starts/stops if you didn't dedup...

[lguinn2 · Accepted solution]

Try this:

EventCode=7035 
| dedup Message 
| rex field=Message "The (?<Extracted_Service_Name>.*?) service was .*? sent a (?<Action>start|stop)"
| table ComputerName Extracted_Service_Name Action

[lguinn2]

To get rid of the blanks,

EventCode=7035
| dedup Message
| rex field=Message "The (?<Extracted_Service_Name>.*?) service was .*? sent a (?<Action>start|stop)"
| where Extracted_Service_Name!=null()
| table ComputerName Extracted_Service_Name Action

But can you show an example of an event where it extracted blanks? I wonder if the regular expression could be better...

[MrWh1t3]

It picks up a few "blank" Extracted_Service_Name, but I think this will be, ok. I really appreciate it. I also see where I was going wrong. Thanks a lot!!!