Refine your search:

Hi,

I'm trying to search a multiline event from a windows server. I need to find out which changes was made with a file. So I have to parse the Accesses. The field Accesses show me only the first entry but I need them all. Have you any idea how I can search the events and find out the differnet accesses of a file?

For example an excerpt of the event.

    Accesses:   READ_CONTROL 
        ReadData (or ListDirectory) 
        WriteData (or AddFile) 
        AppendData (or AddSubdirectory or CreatePipeInstance) 
        ReadEA 
        WriteEA 
        ReadAttributes 
        WriteAttributes

At the end of my search I will show a report where I can see which operation will be done with the files. It should shown as a table. But first I have to figure out how to get the values out of the multiline event.

Thanks for your help.

asked 25 Apr '12, 06:59

krusty's gravatar image

krusty
1151111
accept rate: 12%

edited 25 Apr '12, 07:01

Be the first one to answer this question!
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×433
×92

Asked: 25 Apr '12, 06:59

Seen: 452 times

Last updated: 25 Apr '12, 07:01

Copyright © 2005-2012 Splunk Inc. All rights reserved.