All Apps and Add-ons

Splunk Add-on for Cisco WSA: How to extract the user from Cisco WSA logs?

kiran331
Builder

Hi

From the Cisco WSA logs, I get the user information as user=ABCDEFEGH\kiran@ka.ABCDEFEGH.com.

What should I use in props.conf to extract the user by removing

ABCDEFEGH\ 

and

@ka.ABCDEFEGH.com 

at indexing time?

0 Karma

sk314
Builder

Try this:

EXTRACT-username = user=[^\\]+\\(?<username>[^@]+)@
0 Karma

kiran331
Builder

Hi Sk314, Thanks for the response, I tried its not working.

0 Karma

sk314
Builder

can you paste your entry in props.conf here? Does this work in search

<your index and sourcetype> | rex field=_raw "user=[^\\]+\\(?<username>[^@]+)@" | table username
0 Karma

kiran331
Builder

[cisco:wsa:squid]
EXTRACT-username = cs_username=[^\]+\(?[^@]+)@

When I run search i got error

Error in 'rex' command: Encountered the following error while compiling the regex 'user=[^]+(?[^@]+)@': Regex: unmatched parentheses

0 Karma

sk314
Builder

Try this instead:

<your index and sourcetype> | rex field=_raw "user=[^\\\]+\\\(?<username>[^@]+)@" | table username
0 Karma

kiran331
Builder

Its working, But not for all users

0 Karma

sk314
Builder

Can you specify where it fails? I just saw that you use cs_username in your props? You might be better off using Splunk's field extractor instead.
Reference: https://docs.splunk.com/Documentation/Splunk/6.5.0/Knowledge/ExtractfieldsinteractivelywithIFX

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...