topic Re: Regex for F5 BIG IP ASM logs in Splunk Search

Regex for F5 BIG IP ASM logs

jwalzerpitt — Wed, 22 May 2019 15:35:44 GMT

There is a field - req_status - for F5 Big IP ASM logs and right now when I view the values, I expect to see three:

Passed
Blocked
Alerted

However, when I view the values, I am seeing values that are truncated like as follows:

"pa
"p
"pas
"pass
"passe
"
"passed

Here is a snippet of the log (verbiage before and after the snippet):

.....req_status="passed",resp="Logging rate limit reached".....

I tried using ,req_status=(\"\w+)", for my regex and it looks clean on regex101.com, but not Splunk.

Any suggestions to clean up the regex would be greatly appreciated

Thx

Re: Regex for F5 BIG IP ASM logs

koshyk — Wed, 22 May 2019 16:00:49 GMT

Please try

|rex "req_status=\"(?<req_status>[^\"]+)\""

Re: Regex for F5 BIG IP ASM logs

abhijeetbandre — Wed, 22 May 2019 16:21:36 GMT

Try below regex .

req_status=\"(?\w+[^\"]),Try below regex and let me know .

req_status=\"(?[^\"]+[^\"])

Re: Regex for F5 BIG IP ASM logs

jwalzerpitt — Wed, 22 May 2019 17:39:40 GMT

Thx for the rex

When I apply it, I'm seeing values other than the three listed:

May 21 16:24:21 <hostname> ASM:f5_asm=dest-F5-ASM,attack_type=

and some other variations of that

Re: Regex for F5 BIG IP ASM logs

jwalzerpitt — Wed, 22 May 2019 17:41:26 GMT

Thx for the two rexes.

Applying the first rex, I get the truncated values

Applying the second rex, I get values other than the three I'm looking for:

May 21 16:24:21 <hostname> ASM:f5_asm=dest-F5-ASM,attack_type=

Thx

Re: Regex for F5 BIG IP ASM logs

koshyk — Wed, 22 May 2019 21:24:34 GMT

please give the whole event as a sample, so we can write the regex for you

Re: Regex for F5 BIG IP ASM logs

marycordova — Wed, 22 May 2019 21:26:37 GMT

Please post samples of the full raw log event (sanitized) as well as the current configuration (props.conf probably) for parsing this field.

Re: Regex for F5 BIG IP ASM logs

DavidHourani — Thu, 23 May 2019 06:28:08 GMT

Hi @jwalzerpitt,

The problem is not in the regex but it's with the KV_MODE in props.conf of your sourcetype. It's trying to automatically extract the field and sometimes ends up breaking it if the event if truncated.

Go into your props.conf and change the KV_MODE to none then restart your search head and then try your regex again, should work like a charm.

Cheers,
David