Splunk Search

Trouble creating a new field

gforster
New Member
2017-06-06 08:30:56,761 [ajp-127.0.0.4-8009-44] INFO  Weblogger  - 3B08FDCAF216658E81536A07B9D5772E: cdbarnes: reset randomusername LDAP password. ticket: 3121467

Given the above line from a log, I need to have a field for "randomusername." The goal would then be to plot it on a timechart so that it can readily be discerned how many times a given user changes their password within a timeframe. I'm not sure of the best approach to isolate the username and make it its own field to begin with.

thanks

Tags (1)
0 Karma

niketn
Legend

You can begin using rex command, one example is below

<Your Base Search>
| rex field=_raw "reset (?<UserName>.+) LDAP password"
| table UserName _raw

However, you should ideally perform the same using Interactive Field Extraction (IFX) through the Extract New Fields option through your Splunk Search screen. Refer to the documentation for Step By Step process. Two advantages would be
1) Splunk will generate/adjust regular expression based on your data/needs
2) Fields will persist as Knowledge Object hence can be reused.
3) You can override with your own regular expression.

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/ExtractfieldsinteractivelywithIFX

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

adonio
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...