topic Re: How to create a table for pfsense firewall logs using rex command? in Splunk Search

How to create a table for pfsense firewall logs using rex command?

jawadak — Wed, 25 Apr 2018 07:18:33 GMT

I was trying to create a table for pfsense firewall logs using rex command. But it is not creating a table, instead showing the raw logs.

host="pfsense-firewall" "filterlog:" | rex field=_raw "filterlog:\s[0-9],[0-9],,[0-9],(?[0-9A-Za-z]),(?[A-Za-z]),(?[A-Za-z]),(?[A-Za-z]),[0-9],[0-9A-Za-z\s],[0-9],[0-9],[0-9],[0-9],[0-9A-Za-z],(?[0-9]),(?[A-Za-z0-9]),[0-9],(?[A-Za-z0-9.:]),(?[A-Za-z0-9.:]),(?[0-9]),(?[0-9]*)"

Can anyone point the error in the above command?

Re: How to create a table for pfsense firewall logs using rex command?

somesoni2 — Wed, 25 Apr 2018 16:38:26 GMT

The rex command just extracts fields from raw data, doesn't show in tabular format. You should be able to see the fields (if extraction is correct) on the field sidebar on the left. You'd need to specify a table command explicitly, with the fields that you want, to view a tabular output.

Re: How to create a table for pfsense firewall logs using rex command?

TISKAR — Wed, 25 Apr 2018 22:05:12 GMT

@jawadak, can you try by this:

host="pfsense-firewall" "filterlog:" | rex field=_raw "filterlog:\s[0-9],[0-9],,[0-9],(?<field1>[0-9A-Za-z]),(?<field2>[A-Za-z]),(?<field3>[A-Za-z]),(?<field4>[A-Za-z]),[0-9],[0-9A-Za-z\s],[0-9],[0-9],[0-9],[0-9],[0-9A-Za-z],(?[0-9]),(?<field5>[A-Za-z0-9]),[0-9],(?<field6>[A-Za-z0-9.\:]),(?<field7>[A-Za-z0-9.\:]),(?<field8>[0-9]),(?<field9>[0-9]*)"| table field*

If that not work can you please share the exampleof one event to test.

Regards

Re: How to create a table for pfsense firewall logs using rex command?

jawadak — Thu, 26 Apr 2018 05:56:25 GMT

Thanks, it worked