Splunk Search

field extraction in splunk

Ravan
Path Finder

I have a field called: Message which contain below type of data.

   MESSAGE

Special privileges assigned to new logon: User Name: XXXXXXX Domain: XXXX Logon ID: (0x0,0x56099C) Privileges: SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege

Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-781236058-484112869-721245543-19519 Account Name: XXXX Account Domain: XXXX Logon ID: 0x56d9cb9d Privileges: SeSecurityPrivilege SeBackupPrivilege SeRestorePrivilege SeTakeOwnershipPrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeLoadDriverPrivilege SeImpersonatePrivilege

  • How can i extract Privileges information in to an another field.
Tags (1)
0 Karma
1 Solution

lguinn2
Legend

One way is to use the rex command:

<your search here> | rex field=Message "(?m)Privileges:\s(?<Privileges>.*)" | <whatever you want do next>

This will create a field named Privileges that contains everything following the word Privileges to the end of the event. The rex command creates a temporary field. If you want a permanent field, you could use the Interactive Field Extractor, or edit props.conf, with the same regular expression that I have given above.

Of course, this creates a Privileges field that is just a big string. If you want to create a multi-valued field, where each privilege is a separate value, that is a little different. What do you want to do with this field?

View solution in original post

lguinn2
Legend

One way is to use the rex command:

<your search here> | rex field=Message "(?m)Privileges:\s(?<Privileges>.*)" | <whatever you want do next>

This will create a field named Privileges that contains everything following the word Privileges to the end of the event. The rex command creates a temporary field. If you want a permanent field, you could use the Interactive Field Extractor, or edit props.conf, with the same regular expression that I have given above.

Of course, this creates a Privileges field that is just a big string. If you want to create a multi-valued field, where each privilege is a separate value, that is a little different. What do you want to do with this field?

lguinn2
Legend

i just added (?m) to the regular expression; see if that will get all the privileges. If not, try (?ms) at the beginning of the regular expression.

0 Karma

Ravan
Path Finder

karma,

Thanks for the update , This information i am extracting form a windows security log events(576/4672) to find out the user who logged in is an Admin or Not.

Please let me know if there is an other way to track admin logons...

And the above query is giving only first privileges , is there is any flag or smtng which give all privileges(i.e up to end of the log)

0 Karma
Get Updates on the Splunk Community!

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...

The Visibility Gap: Hybrid Networks and IT Services

The most forward thinking enterprises among us see their network as much more than infrastructure – it's their ...

Get Operational Insights Quickly with Natural Language on the Splunk Platform

In today’s fast-paced digital world, turning data into actionable insights is essential for success. With ...