topic Re: field extraction in Getting Data In

field extraction

pavanbmishra — Thu, 05 Nov 2020 15:55:44 GMT

Hi All,

what should be the regex while doing event extraction for srcip

eventtime=1604591829395228259 appid=41 srcip=192.168.1.1 dstip=192.168.2.2 srcport=47450 dstport=443

gcusello — Thu, 05 Nov 2020 16:02:01 GMT

you shouldn't need to extract the srcip field because Splunk automatically recognizes the pairs "field=value".

Anyway, you can extract the value of srcip using the following regex:

| rex "srcip\=(?<srcip>\d+\.\d+\.\d+\.\d+)"

Ciao.

Giuseppe

pavanbmishra — Thu, 05 Nov 2020 16:36:19 GMT

Thanks,

And what about action field here

applist="sniffer-profile" action="pass" appcat="Network.Service"

gcusello — Thu, 05 Nov 2020 16:42:25 GMT

sam answer: you don't need field extractions, but if you want you can use one or three similar regexes:

one regex

| rex "applist\=\"(?<applist>[^\"]+)\"\s+action\=\"(?<action>[^\"]+)\"\s+ appcat\=\"(?<appcat>[^\"]+)\""

three regexes:

| rex "applist\=\"(?<applist>[^\"]+)\"" | rex "action\=\"(?<action>[^\"]+)\"" | rex "appcat\=\"(?<appcat>[^\"]+)\""

Ciao.

Giuseppe