I have some ADFS logs that I'm trying to pull the IPs from. My regex is as follows:
(?:(^Token\sType):\s*(?:\n(?!Client IP:).*)+\nClient IP:\s*\n|\G)(?<adfs_src>(?:\d{1,3}\.){3}\d{1,3})(?:[,\s]|$)
I tested the regex against an ADFS event on regex101 - link text successfully.
However, pasting into Splunk, the IPs aren't being pulled out as the adfs_src field
Any help would be greatly appreciated
Thx
Hi jwalzerpitt,
Try to make it work using the rex
command in Splunk, and start with a simplified regex like this:
.... | rex "Client IP:\s+\n|\G(?<adfs_src>(?:\d{1,3}\.){3}\d{1,3})(?:[,\s]|$)"
Once this works, work your way back to add more criteria to the regex.
cheers, MuS
You have both the global
and multiline
flags set so you need to ensure that these are set in Splunk, too. Try this:
.... | rex max_match=0 "(?ms)Client IP:\s+\n|\G(?<adfs_src>(?:\d{1,3}\.){3}\d{1,3})(?:[,\s]|$)"
That worked as well - thx
Hi jwalzerpitt,
Try to make it work using the rex
command in Splunk, and start with a simplified regex like this:
.... | rex "Client IP:\s+\n|\G(?<adfs_src>(?:\d{1,3}\.){3}\d{1,3})(?:[,\s]|$)"
Once this works, work your way back to add more criteria to the regex.
cheers, MuS
I simplified as follows and it worked like a charm - thx MuS!
(Client IP:\s*\n|\G)(?<adfs_src>(?:\d{1,3}\.){3}\d{1,3})(?:[,\s]|$)
Nice, converted to answer. Please accept 🙂
cheers, MuS