The first dot is the id of the eventlog category, this might be more than one digit.
.{3} [0-9]+ [0-9:]{8} [0-9]+\.(1102) ([^ ]+) (.*)
Therefor you have the [0-9]+ what matches any number.
Addtionally, the Eventlog entry in your example does not have the date that the regex expects and does not look like a windows event log entry.
The first regexes up to the 8} are only to match for the date string that is the prefix in every windows event log line.
That is the part that i find strange but i am following the examples and they seem to do it like that.
I used regex 101 now and i noticed a mistake and adjust accordingly
.{3} [0-9]+ [0-9:]{8} ..1102 \S+ The audit log was cleared. Subject: Security ID: \S* Account Name: (\S+) Account Domain: \S+ Logon ID: \S+
Still using the numbers in the front and it is working, or should i just ignore the examples in the link?
This topic was automatically closed 365 days after the last reply. New replies are no longer allowed. Contact an admin if you think this should be re-opened.
