Splunk Search

How to change a rex field extraction to an inputs.conf file?

Splunkster45
Communicator

Here I am asking another question, but I think that this one will help me with other questions that I've had.

Currently, I've been using the rex command rex field=_raw ".*Login succeeded for user: (?.*)" to extract a user from a log file. However, this has been making other things more difficult such as tags and lookup files. I'm interested in setting this in the inputs.conf file so that the field username will be logged automatically.

http://docs.splunk.com/Documentation/Splunk/6.1.3/admin/inputsconf

It looks like regex is the key to capturing the 'user' information. I'm a little familiar with regex, but am not exactly sure of how to do this.
I believe that the code will look something like the following:

user = ".*Login succeeded for user: (?<user>.*)"
user = ".*Login failed for user: (?<user>.*)"

Does this appears to be correct?
Does calling one field a second time overide the first value or does it find all criteria that match both instances?

Unfortunately, where I work I can't update my own file and implement it. I have to send the updated inputs.conf file off to another team who will implement it. This means that I'll need to get it right the first time and am limited in the amount of testing that I can do.

Currently, our inputs.conf file has 3 components: location of log file, index and sourcetype

Thanks in advance!

0 Karma
1 Solution

aweitzman
Motivator

This looks to me like more of a job for props.conf than inputs.conf. It might look something like this:

props.conf

[appropriate-sourcetype-goes-here]
EXTRACT-user = Login (succeeded|failed) for user: (?<user>.*)

See http://docs.splunk.com/Documentation/Splunk/6.1.3/Knowledge/Createandmaintainsearch-timefieldextract... for more info on ways to do this.

View solution in original post

aweitzman
Motivator

This looks to me like more of a job for props.conf than inputs.conf. It might look something like this:

props.conf

[appropriate-sourcetype-goes-here]
EXTRACT-user = Login (succeeded|failed) for user: (?<user>.*)

See http://docs.splunk.com/Documentation/Splunk/6.1.3/Knowledge/Createandmaintainsearch-timefieldextract... for more info on ways to do this.

gkanapathy
Splunk Employee
Splunk Employee

You can also do this thru the Admin/Management UI, if your admins will let you. You do not have to edit the files directly.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...