All Apps and Add-ons

How to configure additional extractions on the "Message" field based on EventCode for WindowsEvent?

junxianli
Explorer

Hi all,

I am trying to source a way to only perform a certain set of extractions on the "Message" field, when EventCode=4265 (e.g).

Anyone has any clue? I don't want to apply the extraction directly on each event, as it may cause performance issue.

0 Karma

aakwah
Builder

Hello,

you can do the following

index=windows_events EventCode=4265 | rex "your_regex"

you can use erex to help you in building regex as per the following

index=windows_events EventCode=4265 | erex Message examples="error,login"

Regards,
Ahmed

0 Karma

aakwah
Builder

Yes that can be done, run the query on search

index=windows_events EventCode=4265

Then at the bottom of Fields bar (on left down corner of web interface)
press Extract New Fields
select any sample event
click Next
mark 4265 # the value of Event code we want to add to the regex
a menu will appear, select Require, then Add Required Text
mark the part pf the message you want to extract
a menu will appear, select Extract, provide Field Name, then Add Extraction
click Next
validate results
save

The generated regex will be added to props.conf

Regards,
Ahmed

0 Karma

junxianli
Explorer

Any ways to perform it via props.conf, transforms.conf or other .confs, instead of doing it within the search string?

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...