There is a field - req_status - for F5 Big IP ASM logs and right now when I view the values, I expect to see three:
However, when I view the values, I am seeing values that are truncated like as follows:
"pa
"p
"pas
"pass
"passe
"
"passed
Here is a snippet of the log (verbiage before and after the snippet):
.....req_status="passed",resp="Logging rate limit reached".....
I tried using ,req_status=(\"\w+)",
for my regex and it looks clean on regex101.com, but not Splunk.
Any suggestions to clean up the regex would be greatly appreciated
Thx
Hi @jwalzerpitt,
The problem is not in the regex but it's with the KV_MODE
in props.conf
of your sourcetype. It's trying to automatically extract the field and sometimes ends up breaking it if the event if truncated.
Go into your props.conf
and change the KV_MODE
to none
then restart your search head and then try your regex again, should work like a charm.
Cheers,
David
Please post samples of the full raw log event (sanitized) as well as the current configuration (props.conf probably) for parsing this field.
Try below regex .
req_status=\"(?\w+[^\"]),Try below regex and let me know .
req_status=\"(?[^\"]+[^\"])
Thx for the two rexes.
Applying the first rex, I get the truncated values
Applying the second rex, I get values other than the three I'm looking for:
May 21 16:24:21 <hostname> ASM:f5_asm=dest-F5-ASM,attack_type=
Thx
Please try
|rex "req_status=\"(?<req_status>[^\"]+)\""
Thx for the rex
When I apply it, I'm seeing values other than the three listed:
May 21 16:24:21 <hostname> ASM:f5_asm=dest-F5-ASM,attack_type=
and some other variations of that
please give the whole event as a sample, so we can write the regex for you