Splunk Search

Help with regex with two different type events

vrmandadi
Builder

Hello I have the below sample events
Thu Sep 5 10:00:02 EDT 2019 XDB EXPIRED & LOCKED 28-SEP-11 CTXAPP

Thu Sep 5 10:00:02 EDT 2019 VWEinsnte3345 LOCKED GPW_READ
Thu Sep 5 10:00:02 EDT 2019 SK_RYT LOCKED(TIMED) CDS_SELECT_ALL

I want to extract XDB , VWEinsnte3345 ,SK_RYT AS USERNAME and EXPIRED & LOCKED , LOCKED , LOCKED(TIMED) as status , 28-SEP-11 as expiry date(this field is not there for all events) and CTXAPP , GPW_READ , CDS_SELECT_ALL as ROLE

Below is the regex I am using but this is only extracting for event 2

EDT\s\d*\s(?<USERNAME>[^\s]+)\s*(?<STATUS>[^ ]+)\s*(?<ROLE>[^ ]+)

Thanks in advance

0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi vrmandadi,
you could try to use two regexes to extract fields:

| rex "EDT\s\d*\s(?<USERNAME>[^\s]+)\s*(?<STATUS>.*)\s+(?<ROLE>[^ ]+)$"
| rex field=STATUS "(?<STATUS1>.*)\s+(?<expity_date>\d+-\w+-\d+)"
| eval STATUS=coalesce(STATUS1, STATUS)

The second regex runs with events with expiry date and the second one with events without it.
You can test the first regex in https://regex101.com/r/oNrmd0/1 and the second one in https://regex101.com/r/oNrmd0/2

Bye.
Giuseppe

View solution in original post

gcusello
SplunkTrust
SplunkTrust

Hi vrmandadi,
you could try to use two regexes to extract fields:

| rex "EDT\s\d*\s(?<USERNAME>[^\s]+)\s*(?<STATUS>.*)\s+(?<ROLE>[^ ]+)$"
| rex field=STATUS "(?<STATUS1>.*)\s+(?<expity_date>\d+-\w+-\d+)"
| eval STATUS=coalesce(STATUS1, STATUS)

The second regex runs with events with expiry date and the second one with events without it.
You can test the first regex in https://regex101.com/r/oNrmd0/1 and the second one in https://regex101.com/r/oNrmd0/2

Bye.
Giuseppe

vrmandadi
Builder

Thanks Much

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Try this

EDT\s\d*\s(?<USERNAME>[^\s]+)\s*(?<STATUS>\w+( & \w+)?)\s*(?<EXPIRY>\d+-[A-Z]+-\d+)?\s*(?<ROLE>[A-Za-z0-9_-]+)  

regex101.com is your friend.

https://regex101.com/r/ojcpz7/1

0 Karma

vrmandadi
Builder

Hello @DalJeanis I tried your regex but it did not work .I did try that in regex101 but it is not capturing everything for EXPIRY the values are 28-SEP-1 and ROLE has 1 which should be 28-SEP-11 and CTXAPP respectively .
The same with event 2 the status has value LOCKE and ROLE has D

0 Karma

mayurr98
Super Champion

is that your entire event? if not then could pls share the entire event?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...