Splunk Search

Regex for F5 BIG IP ASM logs

jwalzerpitt
Influencer

There is a field - req_status - for F5 Big IP ASM logs and right now when I view the values, I expect to see three:

  1. Passed
  2. Blocked
  3. Alerted

However, when I view the values, I am seeing values that are truncated like as follows:

"pa
"p
"pas
"pass
"passe
"
"passed

Here is a snippet of the log (verbiage before and after the snippet):

.....req_status="passed",resp="Logging rate limit reached".....

I tried using ,req_status=(\"\w+)", for my regex and it looks clean on regex101.com, but not Splunk.

Any suggestions to clean up the regex would be greatly appreciated

Thx

0 Karma

DavidHourani
Super Champion

Hi @jwalzerpitt,

The problem is not in the regex but it's with the KV_MODE in props.conf of your sourcetype. It's trying to automatically extract the field and sometimes ends up breaking it if the event if truncated.

Go into your props.conf and change the KV_MODE to none then restart your search head and then try your regex again, should work like a charm.

Cheers,
David

0 Karma

marycordova
SplunkTrust
SplunkTrust

Please post samples of the full raw log event (sanitized) as well as the current configuration (props.conf probably) for parsing this field.

@marycordova
0 Karma

abhijeetbandre
New Member

Try below regex .

req_status=\"(?\w+[^\"]),Try below regex and let me know .

req_status=\"(?[^\"]+[^\"])

0 Karma

jwalzerpitt
Influencer

Thx for the two rexes.

Applying the first rex, I get the truncated values

Applying the second rex, I get values other than the three I'm looking for:

May 21 16:24:21 <hostname> ASM:f5_asm=dest-F5-ASM,attack_type=

Thx

0 Karma

koshyk
Super Champion

Please try

|rex "req_status=\"(?<req_status>[^\"]+)\""
0 Karma

jwalzerpitt
Influencer

Thx for the rex

When I apply it, I'm seeing values other than the three listed:

May 21 16:24:21 <hostname> ASM:f5_asm=dest-F5-ASM,attack_type=

and some other variations of that

0 Karma

koshyk
Super Champion

please give the whole event as a sample, so we can write the regex for you

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...