field extraction in splunk

[Ravan]

I have a field called: Message which contain below type of data.

   MESSAGE

Special privileges assigned to new logon: User Name: XXXXXXX Domain: XXXX Logon ID: (0x0,0x56099C) Privileges: SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege

Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-781236058-484112869-721245543-19519 Account Name: XXXX Account Domain: XXXX Logon ID: 0x56d9cb9d Privileges: SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege

• How can i extract Privileges information in to an another field.

[lguinn2 · Accepted solution]

One way is to use the rex command:

<your search here> | rex field=Message "(?m)Privileges:\s(?<Privileges>.*)" | <whatever you want do next>

This will create a field named Privileges that contains everything following the word Privileges to the end of the event. The rex command creates a temporary field. If you want a permanent field, you could use the Interactive Field Extractor, or edit props.conf, with the same regular expression that I have given above.

Of course, this creates a Privileges field that is just a big string. If you want to create a multi-valued field, where each privilege is a separate value, that is a little different. What do you want to do with this field?

[lguinn2]

i just added (?m) to the regular expression; see if that will get all the privileges. If not, try (?ms) at the beginning of the regular expression.

[Ravan]

karma,

Thanks for the update , This information i am extracting form a windows security log events(576/4672) to find out the user who logged in is an Admin or Not.

Please let me know if there is an other way to track admin logons...

And the above query is giving only first privileges , is there is any flag or smtng which give all privileges(i.e up to end of the log)