topic Re: Help with regex with two different type events in Splunk Search

Help with regex with two different type events

vrmandadi — Wed, 30 Sep 2020 02:04:50 GMT

Hello I have the below sample events
Thu Sep 5 10:00:02 EDT 2019 XDB EXPIRED & LOCKED 28-SEP-11 CTXAPP

Thu Sep 5 10:00:02 EDT 2019 VWEinsnte3345 LOCKED GPW_READ
Thu Sep 5 10:00:02 EDT 2019 SK_RYT LOCKED(TIMED) CDS_SELECT_ALL

I want to extract XDB , VWEinsnte3345 ,SK_RYT AS USERNAME and EXPIRED & LOCKED , LOCKED , LOCKED(TIMED) as status , 28-SEP-11 as expiry date(this field is not there for all events) and CTXAPP , GPW_READ , CDS_SELECT_ALL as ROLE

Below is the regex I am using but this is only extracting for event 2

EDT\s\d*\s(?<USERNAME>[^\s]+)\s*(?<STATUS>[^ ]+)\s*(?<ROLE>[^ ]+)

Thanks in advance

Re: Help with regex with two different type events

DalJeanis — Thu, 05 Sep 2019 14:27:48 GMT

Try this

EDT\s\d*\s(?<USERNAME>[^\s]+)\s*(?<STATUS>\w+( & \w+)?)\s*(?<EXPIRY>\d+-[A-Z]+-\d+)?\s*(?<ROLE>[A-Za-z0-9_-]+)

regex101.com is your friend.

https://regex101.com/r/ojcpz7/1

Re: Help with regex with two different type events

vrmandadi — Thu, 05 Sep 2019 14:35:01 GMT

Hello @DalJeanis I tried your regex but it did not work .I did try that in regex101 but it is not capturing everything for EXPIRY the values are 28-SEP-1 and ROLE has 1 which should be 28-SEP-11 and CTXAPP respectively .
The same with event 2 the status has value LOCKE and ROLE has D

Re: Help with regex with two different type events

gcusello — Thu, 05 Sep 2019 14:37:31 GMT

Hi vrmandadi,
you could try to use two regexes to extract fields:

| rex "EDT\s\d*\s(?<USERNAME>[^\s]+)\s*(?<STATUS>.*)\s+(?<ROLE>[^ ]+)$"
| rex field=STATUS "(?<STATUS1>.*)\s+(?<expity_date>\d+-\w+-\d+)"
| eval STATUS=coalesce(STATUS1, STATUS)

The second regex runs with events with expiry date and the second one with events without it.
You can test the first regex in https://regex101.com/r/oNrmd0/1 and the second one in https://regex101.com/r/oNrmd0/2

Bye.
Giuseppe

Re: Help with regex with two different type events

mayurr98 — Thu, 05 Sep 2019 15:25:37 GMT

is that your entire event? if not then could pls share the entire event?

Re: Help with regex with two different type events

vrmandadi — Fri, 06 Sep 2019 17:45:48 GMT

Thanks Much