Hi there,
I'm trying to extract some data from Windows security logs and filter the counted results.
This search doesn't work though — any help?
index=something (EventCode="4732" OR EventCode="4728" OR EventCode="4756")
| rex "(?i)Subject:W\r\n\tSecurity ID:\t\t(?P<Subject>.+)"
| rex "(?i)Member:\W\r\n\tSecurity ID:\t\t(?P<Member>.+)"
| rex "(?i)Group:\W\r\n\tSecurity ID:\t\t(?P<Group>.+)"
| search group_obj_id="*admin*" OR group_obj_id="*adm*" OR group_obj_id="*admn*"
| convert ctime(_time) AS time
| eval Group_and_time=Group+"--"+time
| stats values(Group_and_time) as "Group added and Time added" dc(Group) as group_count by Member
| where group_count>1
| rename group_count as "Group Count"
First of all, your RegEx does not seem to work ... you have to make it multiline-matching, the case-instensitivity is not necessary. It can be eased down a bit as well. Next, line #5 is sort of redundant, as group_obj_id="*adm*"
covers the other two selections as well. The rest seems to work fine - at leat in my test environment.
This does it for me:
index=something (EventCode="4732" OR EventCode="4728" OR EventCode="4756")
| rex "(?im)Subject:[^:]+:\t*(?P<Subject>.+)\n"
| rex "(?im)Member:[^:]+:\t*(?P<Member>.+)\n"
| rex "(?im)Group:[^:]+:\t*(?P<Group>.+)\n"
| search group_obj_id="*adm*"
| convert ctime(_time) AS time
| eval Group_and_time=Group+"--"+time
| stats values(Group_and_time) as "Group added and Time added" dc(Group) as group_count by Member
| where group_count>1
| rename group_count as "Group Count"
First of all, your RegEx does not seem to work ... you have to make it multiline-matching, the case-instensitivity is not necessary. It can be eased down a bit as well. Next, line #5 is sort of redundant, as group_obj_id="*adm*"
covers the other two selections as well. The rest seems to work fine - at leat in my test environment.
This does it for me:
index=something (EventCode="4732" OR EventCode="4728" OR EventCode="4756")
| rex "(?im)Subject:[^:]+:\t*(?P<Subject>.+)\n"
| rex "(?im)Member:[^:]+:\t*(?P<Member>.+)\n"
| rex "(?im)Group:[^:]+:\t*(?P<Group>.+)\n"
| search group_obj_id="*adm*"
| convert ctime(_time) AS time
| eval Group_and_time=Group+"--"+time
| stats values(Group_and_time) as "Group added and Time added" dc(Group) as group_count by Member
| where group_count>1
| rename group_count as "Group Count"
Thanks again @DMohn 🙂
I'm getting results in the Events tab, however, I can't display any statistics out of it.
I'll try to cut some of the code and see whether anything changes...