Regex for two similar statements to put in transforms.conf ?

[dmacgillivray]

Hello, thanks for everyones assistance on MV_ADD=True response on my last question regarding
multivalued pairs.. Now I have the result of a MV_ADD=True below. Very cleanly they are seperated by 1 & 2 below.

1)new_user
2)original_user

Problem I am having now is to be able to write a regex with field seperators for the two blocks below. Knowing the data inside the fields might change, the field names should not.
Would anyone be able to assist?

Thank You in advance
Daniel MacGillivray

new_user=[userid:[BOBS_MZS_Truck3rdlnsupp1] firstname:[Truck3rdlnsupp1] lastname:[LN] email:[] certdn:[] properties:[[name=ContactID isset=false], [name=ctscPasswordResetAttempts isset=false], [name=ctscSecretQuestionAnswer isset=false]] account_start_date:[Mar 12, 2014 6:08:47 PM] account_expiry_date:[Jan 1, 4712 6:08:47 PM] islockedout:[false] isactive:[true] passwordexpiry_date:[Aug 14, 2014 11:59:26 AM] admin_group:[Person User Admin Group] ispublic:[true]]

original_user=[userid:[BOBS_MZS_Truck3rdlnsupp1] firstname:[Truck3rdlnsupp1] lastname:[LN] email:[] certdn:[] properties:[[name=ContactID isset=false], [name=ctscPasswordResetAttempts isset=false], [name=ctscSecretQuestionAnswer isset=false]] account_start_date:[Mar 12, 2014 6:08:47 PM] account_expiry_date:[Jan 1, 4712 6:08:47 PM] islockedout:[true] isactive:[false] passwordexpiry_date:[Aug 6, 2014 6:02:47 PM] admin_group:[Person User Admin Group] ispublic:[true]]

[richgalloway · Accepted solution]

This should get you started.

[\s\S]*userid:\[(?<userid>[\s\S]+)] firstname:\[(?<firstname>[\s\S]+)] lastname:\[(?<lastname>[\s\S]+)] 

Put it into RegExr along with your sample events and you should be able to finish your regex string in short order.

[richgalloway]

Yes, this string should work in a REGEX statement in your transforms.conf file or in a rex search statement.

[dmacgillivray]

Delayed thank you !!

[dmacgillivray]

Hi Rich, Thanks for the help on this. So I should be able to use this as a sample in the transforms ? Or inside the regex extractor tool in Splunk. Either way, thank you.

Daniel