Can you help me with the following regex expression?

[tmwhitm]

I have been reviewing answers from this forum & Splunk doc but I can't seem to find out why my rex command keeps throwing the error, "Error in 'rex' command: Encountered the following error while compiling the regex '(?<='Logon': Regex: missing closing parenthesis". My rex looks similar to others in this forum and works great on regex101 but I am obviously missing something. Here is my SPL,

source="wineventlog:Security" user=xxxxx (EventCode=4624 OR EventCode=4634)
| rex field=subject (?<=Logon ID:)(.*)(?=\b)
| eval Account_Name=mvindex(Account_Name,1)
| eval User=coalesce(Account_Name,Logon_Account,Logon_account,User_Name)
| eval User=lower(User)

Any guidance is appreciated.

Tom

[kamlesh_vaghela]

@tmwhitm

I have extracted Logon id and added where condition to filter events having Logon ID: 0x16cbfadd7

Can you please try this?

source="wineventlog:Security" user=xxxxx (EventCode=4624 OR EventCode=4634)
| rex field=_raw "Logon ID: (?<Logon_Id>.*)" 
| where Logon_Id="0x16cbfadd7"
| eval Account_Name=mvindex(Account_Name,1)
| eval User=coalesce(Account_Name,Logon_Account,Logon_account,User_Name)
| eval User=lower(User)

[tmwhitm]

That seemed to work very well. Thank you...

[kamlesh_vaghela]

Great
Can you please accept the answer and upvote my comment to help the community?

[kamlesh_vaghela]

Can you please share a sample event which you are going to match??
meanwhile, you can try this.

| rex field=subject "(?<Logon_ID>:)(.*)(?=\b)"

[tmwhitm]

Your rex worked, no error but here is an example of the event. My other question if you would be so kind, I was under the impression that the rex command would change the content of the field name, 'subject' in this case to only contain the result of the rex command, "0x16cbfadd7" from the example below but it doesn't. Where am I wrong?

10/5/18
1:38:55.000 PM

10/05/2018 01:38:55 PM
LogName=Security
SourceName=Microsoft Windows security auditing.
EventCode=4634
EventType=0
Type=Information
ComputerName=AD04.ad.net
TaskCategory=Logoff
OpCode=Info
RecordNumber=826696385
Keywords=Audit Success
Message=An account was logged off.

Subject:
Security ID: AD\xxxxxxx
Account Name: xxxxxxx
Account Domain: AD
Logon ID: 0x16cbfadd7

Logon Type: 3

This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.

[Vijeta]

You need to escape the '\'with another \ . Try this

| rex field=subject (?<=Logon ID:)(.*)(?=\b)

[tmwhitm]

Hi Vijeta, this rex did not work, I received the same error message. I added an example of an event to the post above, that rex did work but I am still missing something with regards to the rex command.