Splunk Search

How come scheduled search is failing with error on regex but is successful with an ad hoc search?

marycordova
SplunkTrust
SplunkTrust

Problem Statement: successful ad hoc search, when saved and scheduled to run periodically, fails with error at position in regex

Error:

status=skipped, Error in 'SearchParser': Missing a search command before '^'. Error at position '8052' of search query 'search index=win* (EventCode=624 OR EventCode=4720...{snipped} {errorcontext = rc_host>^[^\\\]+)"\n| }'

Search:

index=win* (EventCode=624 OR EventCode=4720)
| eval src=mvindex('Security_ID',0)
| rex field=src "(?<src_host>^[^\\\]+)"
| rex field=src "(?<src_user>[^\\\]+)\$*$"
| eval src_host=upper(if(match('src_user',"\$$"),rtrim('src_user',"$"),(if('src_host'=="<domain>",null(),'src_host'))))
| eval src_user=lower(if(match('src_user',"\$$"),rtrim('src_user',"$"),'src_user'))
| eval dest_user=lower('SAM_Account_Name')
| table src_host src_user dest_user
@marycordova
0 Karma
1 Solution

marycordova
SplunkTrust
SplunkTrust

Workaround (JIRA SPL-161618):

  1. replaced instances of \$ followed by any number of characters and then another $ with the hex encoded version of \$ ( \x24 )
  2. the issue has to do with some component of Splunk ( @martin_mueller would know precisely which component ) interpreting $somestuffhere$ as a token

Working Scheduled Search:

index=win* (EventCode=624 OR EventCode=4720)
| eval src=mvindex('Security_ID',0)
| rex field=src "(?<src_host>^[^\\\]+)"
| rex field=src "(?<src_user>[^\\\]+)\x24*$"
| eval src_host=upper(if(match('src_user',"\x24$"),rtrim('src_user',"$"),(if('src_host'=="<domain>",null(),'src_host'))))
| eval src_user=lower(if(match('src_user',"\x24$"),rtrim('src_user',"$"),'src_user'))
| eval dest_user=lower('SAM_Account_Name')
| table src_host src_user dest_user
@marycordova

View solution in original post

marycordova
SplunkTrust
SplunkTrust

Workaround (JIRA SPL-161618):

  1. replaced instances of \$ followed by any number of characters and then another $ with the hex encoded version of \$ ( \x24 )
  2. the issue has to do with some component of Splunk ( @martin_mueller would know precisely which component ) interpreting $somestuffhere$ as a token

Working Scheduled Search:

index=win* (EventCode=624 OR EventCode=4720)
| eval src=mvindex('Security_ID',0)
| rex field=src "(?<src_host>^[^\\\]+)"
| rex field=src "(?<src_user>[^\\\]+)\x24*$"
| eval src_host=upper(if(match('src_user',"\x24$"),rtrim('src_user',"$"),(if('src_host'=="<domain>",null(),'src_host'))))
| eval src_user=lower(if(match('src_user',"\x24$"),rtrim('src_user',"$"),'src_user'))
| eval dest_user=lower('SAM_Account_Name')
| table src_host src_user dest_user
@marycordova
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...