Splunk Search

Rex for cef event and create field alias accordingly

ritikaviavi
Observer

sample CEF:

May 20 20:44:51 10.XX.XX.XX May 20 2019 20:44:51 avcm02.com CEF:0|AV|Control Manager|7.0|BM:1000|Behavior Monitoring|3|rt=May 20 2019 03:34:47 GMT+00:00 dvchost=AV1 cn1Label=Risk_Level cn1=1 cs2Label=Policy cs2=1000 sproc=C:\\Windows\\System32\\taskeng.exe cn2Label=Event_Type cn2=1 cs1Label=Target cs1=C:\\Windows\\system32\\wscript.exe act=3 cn3Label=Operation cn3=101 shost=229Y9G2 src=10.XX.XX.XX deviceFacility=OfficeScan

Our AV is forwarding multiple types of events, in the above mentioned "Behavior Monitoring " events, I want to convert the corresponding shost to field dhost .
How should I place it in props/transforms ?

0 Karma

venkasplunk
New Member

U can try like this

"CEF" | extract pairdelim="{ }" kvdelim="=" | table shost src cs1

0 Karma

venkasplunk
New Member

Can provide some more information so that i will try to give some pointers?

U can try like this

"CEF" | extract pairdelim="{ }" kvdelim="=" | table shost src cs1

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...