Skip to content

Instantly share code, notes, and snippets.

@asachs01

asachs01/event4740_loki_logql_expr.txt

Created September 27, 2023 13:05
Show Gist options
  • Save asachs01/58cf23e1ea9ab5824ef3fbee03288207 to your computer and use it in GitHub Desktop.
Save asachs01/58cf23e1ea9ab5824ef3fbee03288207 to your computer and use it in GitHub Desktop.
Download ZIP
A Grafana Loki logql expression for extracting usernames and lockout sources for event 4740
Raw
event4740_loki_logql_expr.txt
{job="windows_security"}
| json
| event_id = `4740`
| line_format "{{.event_data}}"
| regexp "'TargetUserName'>(?P<UserName>[^<]+)<"
| regexp "'TargetDomainName'>(?P<LockoutSource>[^<]+)<"
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment