Getting Data In

extracting the same field from the same sourcetype in an index, but with multiple log formats

toddblake
Explorer

Linux logs su failures like so:

Sep 23 15:23:25 linuxhost su[6903]: pam_unix(su-l:auth): authentication failure; logname= uid=99 euid=0 tty=pts/3 ruser=nobody rhost=  user=myuser

Whereas solaris logs them like this:

Sep 23 15:07:50 solhost su[23608]: [ID 810491 auth.crit] 'su root' failed for myuser on /dev/pts/1

I wanted to extract a user field using the rex command and came up with the following:

for linux: I can just use the user field

for solaris: rex field=_raw "failed for (?<user>\w) on)"

So ultimately I'd like to be able to search for either string, and then extract the user field and report on that field regardless of log format. Any ideas?

Tags (1)
0 Karma

jonuwz
Influencer

Something like :

rex field=_raw ".*(?:failed for |user=)(?<user>\w+).*"

toddblake
Explorer

oh neat thanks, didn't know there was an OR operator(the pipe) in a regex, and didn't think to parse out the name=value pair since it normally does it on it's own anyway. Seems to do the trick, thanks!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...