Splunk Search

Rex Command Not Working

NightShark
Path Finder

Hello,

The rex command to catch and group the Accesses multi values are not working even though the results in regex101 are fine. Could you guys tell me what I am missing?

Test Log:

 

12/12/2012 04:25:13 PM
LogName=Security
EventCode=5145
EventType=0
ComputerName=test.corp
SourceName=Microsoft Windows security auditing.
Type=Information
RecordNumber=2049592111
Keywords=Audit Success
TaskCategory=Detailed File Share
OpCode=Info
Message=A network share object was checked to see whether client can be granted desired access.
	
Subject:
	Security ID:		User\Test
	Account Name:		Test
	Account Domain:		Test
	Logon ID:		0x117974CE

Network Information:	
	Object Type:		File
	Source Address:		::1
	Source Port:		51234
	
Share Information:
	Share Name:		\\*\C$
	Share Path:		\??\C:\
	Relative Target Name:	Users\Test\Desktop

Access Request Information:
	Access Mask:		0x100081
	Accesses:		SYNCHRONIZE
				ReadData (or ListDirectory)
				ReadAttributes
				
Access Check Results:
	-

 

 

Splunk Rex Query:

 

...
| rex field=Body ".*Access Mask.*\sAccesses:\s(?<Accesses2>.+?)Access\sCheck Results\:.*"

 

 

Thanks,

Regards,

0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=Body "(?ms).*Access Mask.*\sAccesses:\s(?<Accesses2>.+?)Access\sCheck Results\:.*"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=Body "(?ms).*Access Mask.*\sAccesses:\s(?<Accesses2>.+?)Access\sCheck Results\:.*"

NightShark
Path Finder

Thank you very much, working perfect as intended

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...