regex101: PCRE2 (PHP) Match Workspace

(?ms)applies the following effective flags to the remainder of the pattern: gms

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

s modifier: single line. Allows a dot to match line terminators

EventCodethe literal text EventCode (case sensitive)

\=the literal = (61₁₀ / 75₈ / 3D₁₆)

5145the literal text 5145

.*any character, repeated any number of times

Messagethe literal text Message (case sensitive)

\=the literal = (61₁₀ / 75₈ / 3D₁₆)

A network share object was checked to see whether client can be granted desired accessthe literal text A network share object was checked to see whether client can be granted desired access (case sensitive)

.any character

Global pattern flags

g modifier: global. Finds all matches instead of stopping after the first

m modifier: multiline. Causes ^ and $ to match the start and end of each line, not only the start and end of the string

25 tokens

Regular Expression

(?ms)EventCode\=5145.*Message\=A network share object was checked to see whether client can be granted desired access.

New

LogName=Security
SourceName=Microsoft-Windows-Security-Auditing
EventCode=5145
EventType=4
Type=Success Audit
ComputerName=xxxx
Category=11111
CategoryString=none
RecordNumber=xxxx
Message=A network share object was checked to see whether client can be granted desired access.

Subject:
Security ID: 
Account Name: 
Account Domain: 
Logon ID: 

Network Information:
Object Type: File
Source Address: 
Source Port: 

Share Information:
Share Name: 
Share Path: \
Relative Target Name: x.dxmdg.com\Policies\{123456789456456456454654464546464558655}\Machine\Preferences\Registry\Registry.xml

Access Request Information:
Access Mask: 
Accesses: 

Access Check Results: