topic How can I extract the 3 different certificate errors below into a single field within a Splunk query as part of a saved search? in Splunk Search

How can I extract the 3 different certificate errors below into a single field within a Splunk query as part of a saved search?

jacqu3sy — Mon, 05 Feb 2018 11:10:15 GMT

Hi,

I need to extract the 3 different certificate errors below into a single field called CertErrors within a Splunk query as part of a saved search. The regex needs to extract from the final colon after 0126006:4: Peer cert verify error up to the first (

01260006:4: Peer cert verify error: certificate has expired (depth 0
01260006:4: Peer cert verify error: certificate revoked (depth
01260006:4: Peer cert verify error: unable to get local issuer certificate (depth)

Thanks

Re: How can I extract the 3 different certificate errors below into a single field within a Splunk query as part of a saved search?

493669 — Mon, 05 Feb 2018 11:24:38 GMT

hi
Try this:

|rex  max_match=0 "error:\s(?<CertErrors>[^(]+)"

Run this anywhere search:

|makeresults|eval _raw="01260006:4: Peer cert verify error: certificate has expired (depth 0
01260006:4: Peer cert verify error: certificate revoked (depth
01260006:4: Peer cert verify error: unable to get local issuer certificate (depth"
|rex max_match=0 "error:\s(?<CertErrors>[^(]+)"

Re: How can I extract the 3 different certificate errors below into a single field within a Splunk query as part of a saved search?

jacqu3sy — Mon, 05 Feb 2018 11:27:37 GMT

Perfect, thanks.