Splunk Search

Windows Event # 4729

hartfoml
Motivator

How to I extract fields that have the same name:

**Subject:

Security ID:        S-1-5-21-3421131818-2740222167-1022849547-30684
Account Name:       xxxxxxxx
Account Domain:     xxxxxx
Logon ID:       0x2ab3cdc2e

Member:

Security ID:        S-1-5-21-3421131818-2740222167-1022849547-17789
Account Name:       CN=xxxxxx,OU=yyyyyy,OU=zzzz,DC=xxx,DC=xxx,DC=com

Group:

Security ID:        S-1-5-21-3421131818-2740222167-1022849547-512
Group Name:     Domain Admins
Group Domain:       ESCG**

How do I extract out the:
Subject: Account name
Member: Account Name
Group: Group Name

0 Karma

BobM
Builder

You need a multi line EXTRACT looking for the group name followed by any number of indented lines and the words "Account Name:" A props.conf with the below should work. I added in New Logon in case you also need EventCode=4624

[WinEventLog:Security]
EXTRACT-test=(?m)^Subject:[\r\n]+(?:\t[^\r\n]+[\r\n]+)+\t+Account Name:\s+(?<SubjectAccountName>[^\r\n]+)
EXTRACT-test=(?m)^Member:[\r\n]+(?:\t[^\r\n]+[\r\n]+)+\t+Account Name:\s+(?<MemberAccountName>[^\r\n]+)
EXTRACT-test=(?m)^New Logon:[\r\n]+(?:\t[^\r\n]+[\r\n]+)+\t+Account Name:\s+(?<NewAccountName>[^\r\n]+)
EXTRACT-gn=(?m)^\s+Group Name:\s+(?<GroupName>[\r\n]+)

In Explanation
(?m) tells splunk to use multi line matching and
(?:\t[^\r\n]+[\r\n]+)+ matches any number of tab indented lines.

0 Karma

kristian_kolb
Ultra Champion

This looks like a single event from Win2008 WinEvtLog:Security, albeit a bit chopped up.

/k

0 Karma

rroberts
Splunk Employee
Splunk Employee

Which log is this data coming from?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...