topic Re: Looking to parse "Account Name:" value from the log results. in DQL

Parse the "Account Name:" value from the log results

sharjeelb — Thu, 28 Aug 2025 12:29:27 GMT

Log content:

"A user account was locked out.

Subject:

Security ID: S-1-5-18

Account Name: ABCASD$

Account Domain: ABC

Logon ID: 0x3E7

Account That Was Locked Out:

Security ID: S-1-5-21-436374069-1592454029

Account Name: xyz123

Additional Information:

Caller Computer Name:

--------------------------------------------

I'm using this DQL but not getting the expected results:

fetch logs
| filter contains(content, "A user account was locked out")
| parse content, "LD 'Account That Was Locked Out:' LD 'Account Name:' LD:locked_out_account_name"
| fields timestamp, locked_out_account_name, content

----------------------------------------------

Re: Looking to parse "Account Name:" value from the log results.

luis_alcantara — Tue, 26 Aug 2025 15:17:54 GMT

Hi,

I was testing your DPL and I think the solution would be to replace the first two 'LD' with 'DATA', so it would look like this:

DATA 'Account That Was Locked Out:' DATA 'Account Name:' LD:locked_out_account_name

Here’s documentation explaining why 'DATA' should be used in this case: https://docs.dynatrace.com/docs/shortlink/dpl-lines-strings#multiline-data

Re: Looking to parse "Account Name:" value from the log results.

sharjeelb — Tue, 26 Aug 2025 15:18:54 GMT

It worked! Thank you.

Re: Looking to parse "Account Name:" value from the log results.

deni — Fri, 29 Aug 2025 18:23:43 GMT

Thanks a lot! 🙂 Until now I thought that DATA and LD were the same (that’s why I was only using LD—it’s shorter). Also, whenever I needed a new line, I was always adding \n ... 😀