User Name field extraction - Strip DOMAIN in username

[pjohnson1]

I have a field extraction which extracts the User Name. Some users will authenticate with their user name, but some will also pre-fix it by the domain.

How can I strip out the domain in the field extraction if the user includes the domain to authenticate?

username=john.doe
username=domain\john.doe

I referred to this https://answers.splunk.com/answers/172242/how-to-use-rex-to-remove-the-domain-from-the-user.html , but the extraction will only extract those user names pre-fixed by domain.

Thanks.

[southeringtonp]

You can modify your field extraction logic pull out both the user and domain, and allow the domain to be skipped if not present.

The sample below will extract three fields. username will contain the full results, user_domain will contain "domain" in second example above, and will be blank for the first. user will contain john.doe for both examples you gave.

Put the following into your transforms.conf:

[user-with-domain]
REGEX = username=((?:([^\\]+)\\)?(\S+))
FORMAT = username:$1 user_domain::$2 user::$3

And activate it via props.conf:

  [mysourcetype]
  REPORT-user = user-with-domain

[andresito123]

I have tried this workaround but it seems that it doesn't work all the time.

I have 4 sourcetypes (for Sophos Endpoint logs) and I have created this configuration for all of them at the same files (local folder of Splunk_TA_sophos app).

It seems that it works for the three of them and not for the forth. Any ideas why this is happens?

Thanks!

[woodcock]

Like this:

... | rex field=username mode=sed "s/[^\\]*[\\]//"

[MuS]

Hi pjohnson1,

try this crazy regex

your base search here | rex "(?:=(?!\w+\\)|(?<!=)\\)(?<user>\S+)" | ...

This will search for a = not followed by a word character and a \ or a \ not leaded by a = and takes in any non whitespace character as field user - tested and working on http://regex101.com and you will get a better explanation there as well 🙂

Hope this helps ...

cheers, MuS

[pjohnson1]

Hi MuS,

Thanks for the comment.

I tried:

tag=authentication eventtype="aruba-user-authenticated" | rex "(?:=(?!\w+\\\)|(?<!=)\\\)(?<user>\S+)"

But it matches

username=john.doe

but fails

username=domain\john.doe

[MuS]

Sorry my bad, just add max_match=0 to the regex and it will match everything:

 tag=authentication eventtype="aruba-user-authenticated" | rex max_match=0 "(?:=(?!\w+\\\)|(?<!=)\\\)(?<user>\S+)"

[MuS]

this will work as run everywhere search:

| gentimes start=-1 | eval foo="
username=john.doe
username=domain\john.doe
username=other_domain\foo.baz" | rex max_match=0 field=foo "(?:=(?!\w+\\\)|(?<!=)\\\)(?<user>\S+)"  | table user