topic Re: how to extract multiple value in field CEF? in Knowledge Management

how to extract multiple value in field CEF?

riposans — Thu, 26 Sep 2024 17:01:33 GMT

hello all

can help me for this? i get data like this

abc=1|productName= SHAMPTS JODAC RL MTV 36X(4X60G);ABC MANIS RL 12X720G;SO KLIN ROSE FRESH LIQ 24X200ML|field23=tip

i want to extract productName but can't extract because value productName not using " "

so I'm confused to extract it, I've tried it using the spl command

| makemv delim=";" productName

but the only result is SHAMPTS JODAC RL MTV 36X(4X60G). the rest doesn't appear.
and also using regex with the command

| makemv tokenizer="(([[:alnum:]]+ )+([[:word:]]+))" productName

but the result is still the same.

so is there any suggestion so that the value after ; can be extracted?

Re: how to extract multiple value in field CEF?

richgalloway — Thu, 26 Sep 2024 12:08:52 GMT

This question is confusing. The data appears to be delimited by | yet the SPL uses ; as a delimiter.

If the productName field starts after "productName=" and ends before the next | then this command should extract it.

| rex "productName=(?<productName>[^\|]+)"

Re: how to extract multiple value in field CEF?

PickleRick — Tue, 19 Nov 2024 21:43:11 GMT

CEF is a fairly annoying format to deal with. It has some part defined one way - as delimited values, and another as key=value pairs. There is an app on Splunkbase for handling CEF events - https://splunkbase.splunk.com/app/487 But I don't remember if it's any good TBH.