Splunk Search

Problem extracting fields from auto extracted field

ktn01
Path Finder

Hello,

I have events in the following format:

20/08/19 16:34:17 login1 command RunAsUsers="web,tomcat,embed" 

with the following configs

props.conf:

[mysourcetype]
TIME_PREFIX = ^
MAX_TIMESTAMP_LOOKAHEAD = 20
TIME_FORMAT = %d/%m/%y %H:%M:%S
NO_BINARY_CHECK = true
SHOULD_LINEMERGE = false
KV_MODE = auto_escaped
REPORT-mysourcetype = login,user

transforms.conf:

 [login]
 REGEX = ^[\d\s/:]+(?P<user>\w*)\s+(?P<type>\w*)

 [user]
 SOURCE_KEY = RunAsUsers
 REGEX = (?P<user>[^,]+)
 MV_ADD = true

Fields "user", "type" and "RunAsUsers" are well extracted but the multi KV "user" is not created.

An idea of ​​what I'm doing wrong?

Thanks
Christian

0 Karma
1 Solution

ktn01
Path Finder

Hello,

For information, Splunk support give me the following solution using the config file "fields.conf":

[RunAsUsers]
TOKENIZER = ([^,]+)

Regards
Christian

View solution in original post

0 Karma

ktn01
Path Finder

Hello,

For information, Splunk support give me the following solution using the config file "fields.conf":

[RunAsUsers]
TOKENIZER = ([^,]+)

Regards
Christian

0 Karma

ktn01
Path Finder

Sorry, regex on [login] is

^[\d\s/:]+(?P<login>\w*)\s+(?P<type>\w*)

The field login is well extracted but user is not

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...