Splunk Search

How do I write a regex command that extracts the username and replaces the appending -*a with @company.com?

sjcoluccio67
Explorer

I have a search query that finds users whose accounts have been locked out and then sends them an email saying so. These event records do not contain email addresses, but they do contain user names. Each user name is appended with either -fa, -da, or -na at the end (e.g. csteve-pa). If you take the user name and chop off the appendage and add @company.com (e.g. csteve@company.com), it will be a valid email address. I have tried to write a regex command that extracts the username and replaces the appending -*a with @company.com. The regex looks right to me, but splunk is not extracting the email address properly. below is my query and the error that I am getting.

 index=wineventlog sourcetype=WinEventLog:Security EventCode=4740 | eval user_new=user | **rex field=user_new mode=sed "s/\S+(-*a)/@company.com/g"** | sendemail to=$result.user_new$ server=mail.company.com subject="Your account has been locked out!" message="Splunk has detected that the account shown below has been locked out. Please contact Access Admins for assistance." sendresults=true inline=true format=raw **error** command="sendemail", {u'@company.com': (501, '5.1.3 Invalid address')} while sending mail to: @company.com

Any help would be greatly appreciated!

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

This worked for me:

| makeresults | eval user_new="csteve-pa" 
| rex field=user_new mode=sed "s/(\S+)-.a$/\\1@company.com/g"

If I understand the naming that you get, this should work for you.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...