SEC, 9/12/2004, 14:25:18, Security, 576, Success, P +rivilege Use, NT AUTHORITY\SYSTEM, GHOST01, Special privile +ges assigned to new logon:^` User Name: GHOST01$^` Domain: + US^` Logon ID: (0x0 0x15307D9E)^` Privileges: + SeBackupPrivilege^` SeRestorePrivilege^` SeD +ebugPrivilege^` SeChangeNotifyPrivilege
But I get GHOST01$^. How do I remove the ^ char atforeach $line (<INPUT>) { chomp($line); ($logtype, $date, $time, $type, $eventid, $status, $systemevent, $nt +auth, $hostname, $description) = split(",", $line); # So, $description becomes #Special privileges assigned to new logon:^` User Name: GHOST +01$^` Domain: US^` Logon ID: (0x0 0x15307D9E)^` + Privileges: SeBackupPrivilege^` SeRestorePrivilege +^` SeDebugPrivilege^` SeChangeNotifyPrivilege # I just need to get the User Name which is GHOST01$ out. if ($eventid==576) { ($desc, $username) = split("`", $description); ($logon, $uname) = split(":", $username); print $uname; } }
2004-12-10 Janitored by Arunbear - added code tags, as per Monastery guidelines
In reply to Parsing problem by meenac
| For: | Use: | ||
| & | & | ||
| < | < | ||
| > | > | ||
| [ | [ | ||
| ] | ] |