For some reason the builtin field extractor is not working for me, and I am unable to successful create a .conf stanza to parse out some needed fields from ADFS logs. So I have an extracted field called Message that contains all the information to create the new fields I need. Sample events are: The following user account has been locked out due to too many bad password attempts. Additional Data Activity ID: 00000000-0000-0000-0000-000000000000 User: [email protected] Client IP: 129.42.38.7,192.168.2.13 nBad Password Count: 6 nLast Bad Password Attempt: 1/8/2017 The following user account has been locked out due to too many bad password attempts. Additional Data Activity ID: 00000000-0000-0000-0000-000000000000 User: ibm-9\1234 Client IP: 192.168.2.13 nBad Password Count: 6 nLast Bad Password Attempt: 1/9/2017 The two events are similar except for User value and Client IP What I would like to do is rex out all the information into Msg = The following user account has been locked out due to too many bad password attempts. Activity_ID= 00000000-0000-0000-0000-000000000000 Employee= someone OR Employee= 1234 Client_IP= 129.42.38.7,192.168.2.13 OR Client_IP=192.168.2.13 Bad_Password_Count = 6 Last_Bad_Password = 1/8/2017 Here is my initial query index=wineventlog sourcetype="WinEventLog:Security" EventCode=516 | rex field=Message "(?<Employee>.+)@" | rex field=Message "(?<Msg>.+)." |table Msg Employee _time As you can I am using an already extracted field, to get Msg and Employee. I just need a regex Ninja to show me how to slice this up. Thank you BTW why do expressions in regex101 editor not work in the search app (and vice versa)?? Is there a tutorial on the differences? ... View more

I am trying to create and add a regex stanza to Windows TA to parse out a username. This is for event code 516 from a windows security event log. The Windows TA does not parse out a username quite right. The raw event writes the information on two separate lines. ... User: [email protected] .... I started my stanza (with the help of regex101.com) but I am not having success writing a regex that matches [User: ] and then drops to the next line and copies the employee name out of the email address. Here is my starting effort... # Event Code 516 [User:_as_user] SOURCE_KEY = User: REGEX = ??? FORMAT = ??? Please advise how it might be written. Please let me know if you need more information. Thank you ... View more

I have a stand-alone instance of Splunk running on Linux. I have a Universal Forwarder installed on Windows 7 with the intent to collect the Windows event logs. The stand-alone instance was enabled to become a deployment server when I configured the UF (Universal Forwarder) and pointed output back to the Stand-alone. I have good communication and deployed the Splunk Add-on for Microsoft Windows to the UF successfully. However the Windows events are not rolling in. Any ideas where to start troubleshooting this? Thank you ... View more

I have a stand-alone Dev instance of splunk running on Linux. It works great for testing. But now I have to do some testing with Universal Forwarders and need a forwarder manager. Any advise to add this to the mix? Can a forwarder manager role be added to the stand-alone or do I need to run another instance as just a forwarder manager? Thank you ... View more