Parse the "Account Name:" value from the log results

[sharjeelb]

Log content:

"A user account was locked out.

Subject:

Security ID: S-1-5-18

Account Name: ABCASD$

Account Domain: ABC

Logon ID: 0x3E7

Account That Was Locked Out:

Security ID: S-1-5-21-436374069-1592454029

Account Name:      xyz123

Additional Information:

Caller Computer Name:

"

--------------------------------------------

I'm using this DQL but not getting the expected results:

fetch logs
| filter contains(content, "A user account was locked out")
| parse content, "LD 'Account That Was Locked Out:' LD 'Account Name:' LD:locked_out_account_name"
| fields timestamp, locked_out_account_name, content

----------------------------------------------

[luis_alcantara · Accepted solution]

Hi,

I was testing your DPL and I think the solution would be to replace the first two 'LD' with 'DATA', so it would look like this:

DATA 'Account That Was Locked Out:' DATA 'Account Name:' LD:locked_out_account_name

Here’s documentation explaining why 'DATA' should be used in this case: https://docs.dynatrace.com/docs/shortlink/dpl-lines-strings#multiline-data 

[sharjeelb]

It worked! Thank you.

[deni]

Thanks a lot! 🙂 Until now I thought that DATA and LD were the same (that’s why I was only using LD—it’s shorter). Also, whenever I needed a new line, I was always adding \n  ... 😀