Splunk Search

Regex working on regex101 but not in Splunk

jwalzerpitt
Influencer

I have some ADFS logs that I'm trying to pull the IPs from. My regex is as follows:

(?:(^Token\sType):\s*(?:\n(?!Client IP:).*)+\nClient IP:\s*\n|\G)(?<adfs_src>(?:\d{1,3}\.){3}\d{1,3})(?:[,\s]|$)

I tested the regex against an ADFS event on regex101 - link text successfully.

However, pasting into Splunk, the IPs aren't being pulled out as the adfs_src field

Any help would be greatly appreciated

Thx

0 Karma
1 Solution

MuS
SplunkTrust
SplunkTrust

Hi jwalzerpitt,

Try to make it work using the rex command in Splunk, and start with a simplified regex like this:

.... | rex "Client IP:\s+\n|\G(?<adfs_src>(?:\d{1,3}\.){3}\d{1,3})(?:[,\s]|$)" 

Once this works, work your way back to add more criteria to the regex.

cheers, MuS

View solution in original post

woodcock
Esteemed Legend

You have both the global and multiline flags set so you need to ensure that these are set in Splunk, too. Try this:

 .... | rex max_match=0 "(?ms)Client IP:\s+\n|\G(?<adfs_src>(?:\d{1,3}\.){3}\d{1,3})(?:[,\s]|$)" 

jwalzerpitt
Influencer

That worked as well - thx

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi jwalzerpitt,

Try to make it work using the rex command in Splunk, and start with a simplified regex like this:

.... | rex "Client IP:\s+\n|\G(?<adfs_src>(?:\d{1,3}\.){3}\d{1,3})(?:[,\s]|$)" 

Once this works, work your way back to add more criteria to the regex.

cheers, MuS

jwalzerpitt
Influencer

I simplified as follows and it worked like a charm - thx MuS!

(Client IP:\s*\n|\G)(?<adfs_src>(?:\d{1,3}\.){3}\d{1,3})(?:[,\s]|$)
0 Karma

MuS
SplunkTrust
SplunkTrust

Nice, converted to answer. Please accept 🙂

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...