Splunk Search

How to use rex for search time field extraction for syslog events?

smudge797
Path Finder

Im trying to run a search time query on some syslogs and having issues with the format and Im new to regex.

Below is the format of the logs and Im trying to search and create a table with:

date-time 08/13/2014: 12:50:57 GMT |  UI CMD_EXCECUTED xxxxxxx | User xxxxxxxxxx | Remote_ip xxx.xxx.xxx.xxx

Aug 13 05:50:57 10.185.13.58 08/13/2014: 12:50:57 GMT abcde-abc12-xxxlb01 ABC-0 : UI CMD_EXECUTED 7068686 :  User imuser - Remote_ip 192.168.13.51 - Command "stat ns" - Status "Success"
Aug 13 05:50:43 10.185.13.58 08/13/2014: 12:50:43 GMT abcde-abc12-xxxlb01 ABC-0 : UI CMD_EXECUTED 7068676 :  User s-jfred - Remote_ip 192.168.13.51 - Command "stat ns" - Status "Success"
Aug 13 05:50:29 10.185.13.58 08/13/2014: 12:50:29 GMT abcde-abc12-xxxlb01 ABC-0 : UI CMD_EXECUTED 7068667 :  User ssvcs - Remote_ip 192.168.13.51 - Command "stat ns" - Status "Success"
Aug 13 05:50:14 10.185.13.58 08/13/2014: 12:50:14 GMT abcde-abc12-xxxlb01 ABC-0 : UI CMD_EXECUTED 7068658 :  User v-usser - Remote_ip 192.168.13.51 - Command "stat ns" - Status "Success"
Aug 13 05:50:00 10.185.13.58 08/13/2014: 12:50:00 GMT abcde-abc12-xxxlb01 ABC-0 : UI CMD_EXECUTED 7068648 :  User v-usser2 - Remote_ip 192.168.13.51 - Command "stat ns" - Status "Success"
Aug 13 05:49:45 10.185.13.58 08/13/2014: 12:49:45 GMT abcde-abc12-xxxlb01 ABC-0 : UI CMD_EXECUTED 7068639 :  User v-usser3 - Remote_ip 192.168.13.51 - Command "stat ns" - Status "Success"
Aug 13 05:49:31 10.185.13.58 08/13/2014: 12:49:31 GMT abcde-abc12-xxxlb01 ABC-0 : UI CMD_EXECUTED 7068629 :  User v-usser4 - Remote_ip 192.168.13.51 - Command "stat ns" - Status "Success"
Aug 13 05:49:17 10.185.13.58 08/13/2014: 12:49:17 GMT abcde-abc12-xxxlb01 ABC-0 : UI CMD_EXECUTED 7068619 :  User v-usser5 - Remote_ip 192.168.13.51 - Command "stat ns" - Status "Success"
Aug 13 05:49:03 10.185.13.58 08/13/2014: 12:49:02 GMT abcde-abc12-xxxlb01 ABC-0 : UI CMD_EXECUTED 7068610 :  User v-usser6 - Remote_ip 192.168.13.51 - Command "stat ns" - Status "Success"

Thanks!

0 Karma
1 Solution

tom_frotscher
Builder

It should be something like this:

rex "(?<date_time>\d\d\/\d\d\/\d\d\d\d:\s\d\d:\d\d:\d\d\s\w{3}).*UI\sCMD_EXECUTED\s(?<cmd_executed>\d+)\s.*User\s(?<user>\w+)\s-\sRemote_ip\s(?<remote_ip>\d+\.\d+\.\d+\.\d+)"

It is always a good idea to use a regex tester, that are available in the web, to build your regex for the field extractions.

View solution in original post

tom_frotscher
Builder

It should be something like this:

rex "(?<date_time>\d\d\/\d\d\/\d\d\d\d:\s\d\d:\d\d:\d\d\s\w{3}).*UI\sCMD_EXECUTED\s(?<cmd_executed>\d+)\s.*User\s(?<user>\w+)\s-\sRemote_ip\s(?<remote_ip>\d+\.\d+\.\d+\.\d+)"

It is always a good idea to use a regex tester, that are available in the web, to build your regex for the field extractions.

smudge797
Path Finder

Great, works like a champ!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

In case the above doesn't work, try changing "(?\w+)" with "(?[^\s]+)".

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...