Windows Logs Query

Grafana
,
1

Hi,

I’m new to Grafana and I’m pulling in Windows logs via Alloy/Prometheus. I’m trying to generate a regex to extract just the account name from the text below via a regex expression on an extract fields transformation.

I’ve tried all sorts of combinations but get nowhere - hoping someone can assist.

Best Regards,

Kenny

————————————————–

An attempt was made to change an account’s password.

Subject:
Security ID: xxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
Account Name: xxxxxxxxxxxxxxxxxx
Account Domain: xxxxxxxxxxx
Logon ID: xxxxxxxxxxxx

Target Account:
Security ID: xxxxxxxxxxxxxxxxxxxxxxxx
Account Name: testuser
Account Domain: xxxxxxx

Additional Information:
Privileges -

2

please try this
Target Account:[\s\S]?Account Name:\s([^\r\n]+)
i will test and implement your problem using loki datasource
thanks

3

Thanks, still get the same error.