topic Splunk Regular Expression in Splunk Search

Splunk Regular Expression

vasuparvatham — Fri, 08 May 2020 07:10:59 GMT

Hello,

Attached here the list of roles we have. But my regular expression is showing results of only RSI - VPN Users but not all the other roles.

rex "^[^\)\n]*\)\[(?P\w+\s+\-\s+\w+\s+\w+)]"

Can you please help me here?

Entire Query:

index=juniperindex | rex "(?P\w+\s+\d+)\s+(?P\d+:\d+:\d+)\s?+(?P\d+\.\d+\.\d+\.\d+)\s+(?P\d+-\d+-\d+T\d+:\d+:\d+-\d+:\d+)\s+(?P[[:graph:]]+)\s+\w+:\s+\d+-\d+-\d+\s+\d+:\d+:\d+\s+-\s+\w++\s+-\s+\[(?P\d+\.\d+\.\d+\.\d+)\]\s+(?P\w+)\((?P[[:graph:]]+)\)\[\]\s+-\s+(?P.+)"  | rex "^[^\)\n]*\)\[(?P\w+\s+\-\s+\w+\s+\w+)" | rex "^(?:[^'\n]*'){7}(?P\w+)]" | rex "host\s+\'(?P[[:graph:]]+)\'" | rex "address\s+\'(?P[[:graph:]]+)\'" | rex "for\s+user\s+\'(?P[[:alnum:]]+)\'" | rex "reason\s+\'(?P[[:print:]]+)\'"  | rex "^(?:[^'\n]*'){2}\s+(?P\w+)"  | search status=failed OR status=passed | replace "passed" with successful in status | dedup user_name | table  _time IP MAC user_name  status user_group

Re: Splunk Regular Expression

vasuparvatham — Fri, 08 May 2020 07:47:20 GMT

can you please help me with a single regular expression to cut below format of entries in the log file:

Example:

Consultants Special Access
Contractors Windows Users Special Access
PulseSAMRole
RSI - GIB Users
RSI - IT Desktop Users
RSI - ORA Devtrack
RSI - VPN ArchiveContractor Users
RSI - VPN Contractor Mac Users
RSI - VPN Contractor Users
RSI - VPN Contractor Users(Pulse)
RSI - VPN ITSecurity Users
RSI - VPN Users
test
Users
VPN Contractor Pulse

Many thanks in advance.

Re: Splunk Regular Expression

shivanshu1593 — Fri, 08 May 2020 10:59:03 GMT

You can try this:

^(Con.+ess|Pul.+ole|RSI.+|VPN.+ulse|test|Users)

Made a few tweaks with your data here. You can try and test it with more data.

https://regex101.com/r/NFBLP2/1

Let me know if it helps.

Re: Splunk Regular Expression

vasuparvatham — Wed, 13 May 2020 09:20:10 GMT

thank you.

Can you please help me with the syntax for creating a tab called "user_group" and include this regular expression?

ex: | rex

Thanks in advance.

Re: Splunk Regular Expression

shivanshu1593 — Wed, 13 May 2020 09:36:11 GMT

Maybe this can help:

| rex field=_raw "(?<user_group>^(Con.+ess|Pul.+ole|RSI.+|VPN.+ulse|test|Users)"

Re: Splunk Regular Expression

vasuparvatham — Wed, 13 May 2020 09:55:46 GMT

i will try this today and come back in case of any queries. thanks lot.

Re: Splunk Regular Expression

shivanshu1593 — Thu, 14 May 2020 11:42:05 GMT

No worries. If it worked, please accept this as the answer, so that it may help others in the future, should they run into a similar kind of issue.