Splunk Search

Regex field extraction

gonzalogasca
New Member

Splunk Version 6.2.0
Splunk Build 237341 (MacOSX Yosemite)

This is the line I'm looking to extract fields using regex:

15:23:42.730 |LogMessage UserID : jdoe ClientAddress : 172.16.60.54 Severity : 3 EventType : UserLogging ResourceAccessed: Cisco CallManager Administration EventStatus : Failure CompulsoryEvent : No AuditCategory : AdministrativeEvent ComponentID : Cisco CCM Application AuditDetails : Failed to Log into Cisco CCM Webpages App ID: Cisco Tomcat Cluster ID: Node ID: UCM-CLI-P

I'm looking to extract:
jdoe
172.16.60.54

I have tested my regex using:
http://www.regexr.com/39t8f
In regexr the information is :

/UserID\s:\s(.*)\s+ClientAddress\s:\s(\d+.\d+.\d+.\d+)\s+\s+(.*)/g

It correctly maps (.*) and (\d+.\d+.\d+.\d+) as group 1 and group 2.

I tested it using Perl:

if ($line
=~m/.*UserID\s:\s(.*)\s+ClientAddress\s:\s(.*)\s+Severity\s:\s+(\d).*/i) {
        print " Username: " . $1 . " ClientAddress: " . $2 .  "\n";         }

And I can correctly get my fields in $1 and $2.

When I execute this search in Splunk:

Failed to Log into Cisco CCM Webpages | rex field=_raw "UserID\s:\s(?.*)\s+ClientAddress\s:\s(?\d+.\d+.\d+.\d+)\s+"

The USERIDINFORMATION and CLIENTADDRESS fields are not extracted. It can find the records because of the left part of the search, but not on my regex.
Any ideas?

Tags (2)
0 Karma

landen99
Motivator

The capture fields do need names, but also the regex needs to be good. Anything with ".*" is generally troublesome. You should extract the fields with two seperate regexes for efficiency:

(?i)UserID\s+:\s+(?P<user>\w+)
(?i)ClientAddress\s+:\s+(?P<src>[\.\d]+)

This can be pasted straight into the Field Extractions section of splunk or be set at the commandline:

| rex "(?i)UserID\s+:\s+(?P<user>\w+)" | rex "(?i)ClientAddress\s+:\s+(?P<src>[\.\d]+)"
0 Karma

gonzalogasca
New Member

For some reason the HTML Formatting was not adding my fields

0 Karma

Ayn
Legend

I don't see you actually giving your matching groups names? You need to give them names:

rex field=_raw "UserID\s:\s(?<USERIDINFORMATION>.*)\s+ClientAddress\s:\s(?<CLIENTADDRESS>\d+.\d+.\d+.\d+)\s+"
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...