Splunk Search

field extraction in splunk

Ravan
Path Finder

I have a field called: Message which contain below type of data.

   MESSAGE

Special privileges assigned to new logon: User Name: XXXXXXX Domain: XXXX Logon ID: (0x0,0x56099C) Privileges: SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege

Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-781236058-484112869-721245543-19519 Account Name: XXXX Account Domain: XXXX Logon ID: 0x56d9cb9d Privileges: SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege

  • How can i extract Privileges information in to an another field.
Tags (1)
0 Karma
1 Solution

lguinn2
Legend

One way is to use the rex command:

<your search here> | rex field=Message "(?m)Privileges:\s(?<Privileges>.*)" | <whatever you want do next>

This will create a field named Privileges that contains everything following the word Privileges to the end of the event. The rex command creates a temporary field. If you want a permanent field, you could use the Interactive Field Extractor, or edit props.conf, with the same regular expression that I have given above.

Of course, this creates a Privileges field that is just a big string. If you want to create a multi-valued field, where each privilege is a separate value, that is a little different. What do you want to do with this field?

View solution in original post

lguinn2
Legend

One way is to use the rex command:

<your search here> | rex field=Message "(?m)Privileges:\s(?<Privileges>.*)" | <whatever you want do next>

This will create a field named Privileges that contains everything following the word Privileges to the end of the event. The rex command creates a temporary field. If you want a permanent field, you could use the Interactive Field Extractor, or edit props.conf, with the same regular expression that I have given above.

Of course, this creates a Privileges field that is just a big string. If you want to create a multi-valued field, where each privilege is a separate value, that is a little different. What do you want to do with this field?

lguinn2
Legend

i just added (?m) to the regular expression; see if that will get all the privileges. If not, try (?ms) at the beginning of the regular expression.

0 Karma

Ravan
Path Finder

karma,

Thanks for the update , This information i am extracting form a windows security log events(576/4672) to find out the user who logged in is an Admin or Not.

Please let me know if there is an other way to track admin logons...

And the above query is giving only first privileges , is there is any flag or smtng which give all privileges(i.e up to end of the log)

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...