I want to capture the Path (\Απεσταλμένα) and Subject (TYPICAL MAIN SHELF) .  I am using below regex Subject\W\s(?<Subject>.*)  and  rex "Path\W\s(?<Path>\W.*)"    But these are not working . It is not capturing the path while for subject it is capturing many more lines which are not required .   Someone please help    PH0PR07MB8510A5DC1014429F3B411EB1E39B9@PH0PR07MB8510.namprd07.prod.outlook.com> IsRecord: false ParentFolder: { [-] Id: LgAAAACYR3ou5YLkQLdwhKR5o0aGAQDzGy/hF08sRpmozaW+A2HqAAAAdHcNAAAB Path: \Απεσταλμένα } SizeInBytes: 180998 Subject: TYPICAL MAIN SHELF } LogonType: 0 LogonUserSid: S-1-5-21-2050334910-350505970-4048673702-5100548 MailboxGuid: 967cf2f1-6b52-4e79-bf98-1hnfj55667 MailboxOwnerSid: S-1-5-21-2050334910-350505970-499886553 ... View more

Hi all, I need to get the value Windows 7 from the below string . used something like OS[\n]+([^\n]+) , but then it captures from Value till Windows 7.  Could someone please help me in capturing only windows 7? DeviceProperties: [ [-] { [-] Name: OS Value: Windows 7      ... View more

I have this query in Splunk which gets me the src_ip  along with different fields  for the particular UserId. But i want to exclude the logs having src_ip starting with either 10 or 172 . Could someone please help     index=wineventlog $UserId sourcetype="WinEvt:ADFS" EventCode=120* | rex "IpAddress\W(?<src_ip>\d{1,3}.\d{1,3}.\d{1,3}.\d{1,3})" | rex "Activity\sID\W(?<Activity_ID>\s.*)" | table src_ip, Activity_ID, _time, UserAgent | sort _time | reverse ... View more