topic Re: What rex can I use to extract a value before a string near the end of an event? in Splunk Search

What rex can I use to extract a value before a string near the end of an event?

octavioserpa — Tue, 29 Sep 2020 21:45:42 GMT

I need to extract the value where "SoftFail" from this example log is.

In related logs, the value is always after an email address, and before (v=spf1). The value always has one space before it. At first glance, looking for a value after email address seems like it could work, but there are many domain possibilities, including those with subdomains so it's hard to use rex based on @ and x amount of .'s)

Is there away to capture like the following?:

start at end of line
work backwards to space before (v=spf1), capture the value as SPF_Result field, stop at the first space before the value

Oct 25 21:16:05 x.x.x.x Splunk_PIApp_MailLogs_QDC: Info: MID 92041462 SPF: mailfrom identity foo@bar.com SoftFail (v=spf1)

Re: What rex can I use to extract a value before a string near the end of an event?

MuS — Fri, 26 Oct 2018 08:52:17 GMT

Hi octavioserpa,

please remove all IP's or email address before you post log samples 🙂

cheers, MuS

PS: I removed them from this post 😉

Re: What rex can I use to extract a value before a string near the end of an event?

renjith_nair — Fri, 26 Oct 2018 09:39:54 GMT

@octavioserpa,

Try

|rex field=_raw ".*\s(?<SPF_Result>\w+)\s\(v=spf1\)"

|rex field=_raw "(?<SPF_Result>\w+)\s\(v=spf1\)"

Second one is bit expensive 🙂

Re: What rex can I use to extract a value before a string near the end of an event?

inventsekar — Fri, 26 Oct 2018 12:07:45 GMT

| makeresults | eval log="Oct 25 21:16:05 x.x.x.x Splunk_PIApp_MailLogs_QDC: Info: MID 92041462 SPF: mailfrom identity foo@bar.com SoftFail (v=spf1)" 
| rex field=log "(?P<mailid>\w+\@\w+\.\w+) SoftFail"
| table log mailid

Re: What rex can I use to extract a value before a string near the end of an event?

wrangler2x — Fri, 26 Oct 2018 19:08:01 GMT

This will work:

\S@[^\s]+\s+(?<SPF_RESULT>[^ ]+)

See it in action here: https://regex101.com/r/zzf5RJ/1

Re: What rex can I use to extract a value before a string near the end of an event?

renjith_nair — Tue, 30 Oct 2018 06:05:11 GMT

@octavioserpa, if any of the answers helped you , please accept /upvote or comment here if you need further assistance