Splunk Search

How do you use the rex command to filter Windows security events?

swimena
Explorer

Hi there,

I'm trying to extract some data from Windows security logs and filter the counted results.

This search doesn't work though — any help?

index=something (EventCode="4732" OR EventCode="4728" OR EventCode="4756") 
| rex "(?i)Subject:W\r\n\tSecurity ID:\t\t(?P<Subject>.+)"  
| rex "(?i)Member:\W\r\n\tSecurity  ID:\t\t(?P<Member>.+)" 
| rex "(?i)Group:\W\r\n\tSecurity ID:\t\t(?P<Group>.+)"
| search group_obj_id="*admin*" OR group_obj_id="*adm*" OR group_obj_id="*admn*"
| convert ctime(_time) AS time
| eval Group_and_time=Group+"--"+time
| stats values(Group_and_time) as "Group added and Time added" dc(Group) as group_count by Member
| where group_count>1
| rename group_count as "Group Count"
0 Karma
1 Solution

DMohn
Motivator

First of all, your RegEx does not seem to work ... you have to make it multiline-matching, the case-instensitivity is not necessary. It can be eased down a bit as well. Next, line #5 is sort of redundant, as group_obj_id="*adm*" covers the other two selections as well. The rest seems to work fine - at leat in my test environment.

This does it for me:

index=something (EventCode="4732" OR EventCode="4728" OR EventCode="4756") 
| rex "(?im)Subject:[^:]+:\t*(?P<Subject>.+)\n" 
| rex "(?im)Member:[^:]+:\t*(?P<Member>.+)\n" 
| rex "(?im)Group:[^:]+:\t*(?P<Group>.+)\n" 
| search group_obj_id="*adm*"
| convert ctime(_time) AS time 
| eval Group_and_time=Group+"--"+time 
| stats values(Group_and_time) as "Group added and Time added" dc(Group) as group_count by Member 
| where group_count>1 
| rename group_count as "Group Count"

View solution in original post

0 Karma

DMohn
Motivator

First of all, your RegEx does not seem to work ... you have to make it multiline-matching, the case-instensitivity is not necessary. It can be eased down a bit as well. Next, line #5 is sort of redundant, as group_obj_id="*adm*" covers the other two selections as well. The rest seems to work fine - at leat in my test environment.

This does it for me:

index=something (EventCode="4732" OR EventCode="4728" OR EventCode="4756") 
| rex "(?im)Subject:[^:]+:\t*(?P<Subject>.+)\n" 
| rex "(?im)Member:[^:]+:\t*(?P<Member>.+)\n" 
| rex "(?im)Group:[^:]+:\t*(?P<Group>.+)\n" 
| search group_obj_id="*adm*"
| convert ctime(_time) AS time 
| eval Group_and_time=Group+"--"+time 
| stats values(Group_and_time) as "Group added and Time added" dc(Group) as group_count by Member 
| where group_count>1 
| rename group_count as "Group Count"
0 Karma

swimena
Explorer

Thanks again @DMohn 🙂

I'm getting results in the Events tab, however, I can't display any statistics out of it.
I'll try to cut some of the code and see whether anything changes...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...