Splunk Version 6.2.0
Splunk Build 237341 (MacOSX Yosemite)
This is the line I'm looking to extract fields using regex:
15:23:42.730 |LogMessage UserID : jdoe ClientAddress : 172.16.60.54 Severity : 3 EventType : UserLogging ResourceAccessed: Cisco CallManager Administration EventStatus : Failure CompulsoryEvent : No AuditCategory : AdministrativeEvent ComponentID : Cisco CCM Application AuditDetails : Failed to Log into Cisco CCM Webpages App ID: Cisco Tomcat Cluster ID: Node ID: UCM-CLI-P
I'm looking to extract:
jdoe
172.16.60.54
I have tested my regex using:
http://www.regexr.com/39t8f
In regexr the information is :
/UserID\s:\s(.*)\s+ClientAddress\s:\s(\d+.\d+.\d+.\d+)\s+\s+(.*)/g
It correctly maps (.*) and (\d+.\d+.\d+.\d+) as group 1 and group 2.
I tested it using Perl:
if ($line
=~m/.*UserID\s:\s(.*)\s+ClientAddress\s:\s(.*)\s+Severity\s:\s+(\d).*/i) {
print " Username: " . $1 . " ClientAddress: " . $2 . "\n"; }
And I can correctly get my fields in $1 and $2.
When I execute this search in Splunk:
Failed to Log into Cisco CCM Webpages | rex field=_raw "UserID\s:\s(?.*)\s+ClientAddress\s:\s(?\d+.\d+.\d+.\d+)\s+"
The USERIDINFORMATION and CLIENTADDRESS fields are not extracted. It can find the records because of the left part of the search, but not on my regex.
Any ideas?
... View more