Splunk Search

How to extract values from an event?

TB
New Member

Hi,

I am trying to create a table but how do I  extract these information in my query? I tried double quote " " but it's just looking for exact word. 

I want to list out like Subject: Account Name, then Logon Info

 

Subject:
	Security ID:		S-1
	Account Name:		-
	Account Domain:		-
	Logon ID:		0x0

Logon Information:
	Logon Type:		3
	Restricted Admin Mode:	-
	Virtual Account:		No
	Elevated Token:		No

 

rmation: Logon Type: 3. I hope it makes sense. Thank you 

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex "Account Name:\s*(?<accountname>\S*)"
| rex "Logon Type:\s*(?<logontype>\S*)"
0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...