Splunk Search

extracting the value from the match of the "regex" command

darrend
Path Finder

Hi Guys

I have an objective to trawl our data to ensure it is clean of sensitive data for compliance purposes.

I started by using a regex as follows:

index=* | regex "\b4[0-9]{12}(?:[0-9]{3})?\b"

This gives me lots of positive hits, by if a boolean response, yes it matches or no it doesn't, what i want it to extract the matched value to an interesting field to then do some post processing to validate if the number matched passes an LUHN check, this will get rid of more false positives and reduce the number to, hopefully zero responses.

I looked at rex, but from what i can see and my experience that seems to want you to populate the variable you want to extract in the middle of the regex, what i want is more, match this regex and put the match into an interesting field.

Is there something that i am missing to achieve this easily?

Thanks
Darren

Tags (3)
0 Karma

abpe
Path Finder

In props.conf define an EXTRACT to create your field.

EXTRACT-statement = (?Pyour regex)

Then in transforms.conf use the SOURCE_KEY to do another regex match on that particular field.

SOURCE_KEY = your_field

REGEX = ...

FORMAT = result_field::$1 result_field2::$2

0 Karma

abpe
Path Finder

You can pipe two rex statements if you prefer:
| rex field=your_field "(?your regex)" | rex field=new_field "(?your regex)"

0 Karma

darrend
Path Finder

Hi,

This is great, but is there are a way to do it from a runtime search rather than messing with the configuration?

Thanks
Darren

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...