Splunk Version 6.2.0
Splunk Build 237341 (MacOSX Yosemite)
This is the line I'm looking to extract fields using regex:
15:23:42.730 |LogMessage UserID : jdoe ClientAddress : 172.16.60.54 Severity : 3 EventType : UserLogging ResourceAccessed: Cisco CallManager Administration EventStatus : Failure CompulsoryEvent : No AuditCategory : AdministrativeEvent ComponentID : Cisco CCM Application AuditDetails : Failed to Log into Cisco CCM Webpages App ID: Cisco Tomcat Cluster ID: Node ID: UCM-CLI-P
I'm looking to extract:
jdoe
172.16.60.54
I have tested my regex using:
http://www.regexr.com/39t8f
In regexr the information is :
/UserID\s:\s(.*)\s+ClientAddress\s:\s(\d+.\d+.\d+.\d+)\s+\s+(.*)/g
It correctly maps (.*) and (\d+.\d+.\d+.\d+)
as group 1 and group 2.
I tested it using Perl:
if ($line
=~m/.*UserID\s:\s(.*)\s+ClientAddress\s:\s(.*)\s+Severity\s:\s+(\d).*/i) {
print " Username: " . $1 . " ClientAddress: " . $2 . "\n"; }
And I can correctly get my fields in $1 and $2.
When I execute this search in Splunk:
Failed to Log into Cisco CCM Webpages | rex field=_raw "UserID\s:\s(?.*)\s+ClientAddress\s:\s(?\d+.\d+.\d+.\d+)\s+"
The USERIDINFORMATION and CLIENTADDRESS fields are not extracted. It can find the records because of the left part of the search, but not on my regex.
Any ideas?
The capture fields do need names, but also the regex needs to be good. Anything with ".*" is generally troublesome. You should extract the fields with two seperate regexes for efficiency:
(?i)UserID\s+:\s+(?P<user>\w+)
(?i)ClientAddress\s+:\s+(?P<src>[\.\d]+)
This can be pasted straight into the Field Extractions section of splunk or be set at the commandline:
| rex "(?i)UserID\s+:\s+(?P<user>\w+)" | rex "(?i)ClientAddress\s+:\s+(?P<src>[\.\d]+)"
For some reason the HTML Formatting was not adding my fields
I don't see you actually giving your matching groups names? You need to give them names:
rex field=_raw "UserID\s:\s(?<USERIDINFORMATION>.*)\s+ClientAddress\s:\s(?<CLIENTADDRESS>\d+.\d+.\d+.\d+)\s+"