topic Re: Need to extract required fields using rex command in Splunk Search

Need to extract required fields using rex command

rakesh44 — Mon, 29 Apr 2019 09:58:32 GMT

Hi Friends

I am trying to extract required field from events using rex command. Can someone please help me, logs are given in attached doc.

I am new to rex command , Once i get below rex command then easy to understand

Below are fields need to extract

Kernel Audit Begin, Kernel Begin,pam_unix Begin,Postfix Begin,-SSHD Begin,Sudo (secure-log) Begin,Disk Space Begin

Re: Need to extract required fields using rex command

vishaltaneja070 — Mon, 29 Apr 2019 10:39:53 GMT

can you give me the sample value of extraction required for Kernel Audit Begin?

Re: Need to extract required fields using rex command

rakesh44 — Mon, 29 Apr 2019 10:47:03 GMT

I have to prepare dashboard for each field as mentioned, hence need all values of fields.
Kernel Audit Begin : Nee all values of field

Re: Need to extract required fields using rex command

rakesh44 — Mon, 29 Apr 2019 10:48:01 GMT

Unmatched Entries (Only first 100 out of 127 are printed)
dispatch err (pipe full) event lost
dispatch error reporting limit reached - ending report notification.

Re: Need to extract required fields using rex command

gcusello — Mon, 29 Apr 2019 14:05:25 GMT

Hi rakesh44,
let mi know: do you want to extract the following fields?

TimeStamp
Date Range Processed
Detail Level of Output
Type of Output/Format
Logfiles for Host

If these are the fields to extract from the example you shared, try to use the following regex

Processing Initiated: (?<TimeStamp>\w+\s+\w+\s+\d+\s+\d+:\d+:\d+\s+\d+)\s+.*Date Range Processed:\s+yesterday\s+\(\s+(?<Date_Range>[^ ]*)\s+.*\s+.*\s+Detail Level of Output:(?<Level_of_input>[^ ]*)\s+Type of Output\/Format:\s+(?<Type>.*)\s*Logfiles for Host: (?<Logfile>[^ ]*)\s+\#

You can test it at https://regex101.com/r/JNMRCz/1

Bye.
Giuseppe

Re: Need to extract required fields using rex command

rakesh44 — Wed, 30 Sep 2020 00:28:43 GMT

Thanks Gcusello , it worked for me rest I would create it

Processing Initiated: (?\w+\s+\w+\s+\d+\s+\d+:\d+:\d+\s+\d+)\s+.Date Range Processed:\s+yesterday\s+(\s+(?[^ ])\s+.\s+.\s+Detail Level of Output:(?[^ ])\s+Type of Output\/Format:\s+(?.)\s*Logfiles for Host: (?[^ ]*)\s+#

Re: Need to extract required fields using rex command

gcusello — Thu, 09 May 2019 15:01:22 GMT

Good!
if you're satisfied of this answer, please accept and/or upvote it.
At the next time.
Bye.
Giuseppe