topic Trouble with Field Extraction in Splunk Search

Trouble with Field Extraction

tmarlette — Mon, 28 Sep 2020 12:52:46 GMT

I am attempting to pull information from multiple eventtypes into 1 field called ext_ip
I can get two of them, but I can not seem to include the third eventtype in my RegEx.

These are the eventtypes:

(1) Nov 7 11:39:58 bigip03-91 GATEWAY src - 67.43.81.117:1838 INT 33076, LB - 63.75.62.13 - www.website.com - 10.207.220.104

(2) Nov 7 11:52:17 bigip03-91 FIX invalidClient DENIED - 192.193.204.151:1855

(3) Nov 28 11:17:06 bigip03-91 | event=FIX_OUT_DEST_CLOSED_TO_LB|source=10.207.200.32:52818|dest_server_ip_port=76.8.66.33:6506

In this case the information that would be in these fields are IP addresses as follows:

ext_ip=67.43.81.117

ext_ip=192.193.204.151

ext_ip=76.8.66.33

This is the RegEx I am using:
(src|DENIED)\s-\s(?<"ext_ip">\d+.\d+.\d+.\d+)

As you can see, I can get the two even types, but not the third event type IP address into this field "ext_ip". does anyone have any suggestions?

Re: Trouble with Field Extraction

sowings — Wed, 28 Nov 2012 16:50:33 GMT

You'll need to account for the equals sign in the third type. A regex might look like this:

((src|DENIED)\s-\s|dest_server_ip_port\=)(?<"ext_ip">\d+.\d+.\d+.\d+)

Another way to approach it is to create a second rule also capturing a field called ext_ip, which expressly matches the dest_server_ip_port= preface string. There's no reason you can't use separate rules to extract the same field. If the regex doesn't match (i.e., the regex for line types #1 and #2 won't match for line type #3), it won't extract any fields. In this way, you can capture the two distinct sets of log events with a union of extraction rules.

Re: Trouble with Field Extraction

tmarlette — Wed, 28 Nov 2012 17:10:04 GMT

I actually figured it out.

This is the answer:
(src\s-\s|DENIED\s-\s|port=|server=)(?\d+.\d+.\d+.\d+)