topic eval or rex help in Splunk Search

eval or rex help

keyu921 — Fri, 05 Jun 2020 22:52:12 GMT

Message="Internal event: Function ldap_search entered.
SID: S-1-5-18
Source IP: 127.0.0.1:25855
Operation identifier: 680571
Data1:
Data2: 2796807187
Data3:
Data4:"

How can I just left message "Message="Internal event: Function ldap_search entered."

by rex to define as fields or use eval command?

Re: eval or rex help

gcusello — Thu, 21 May 2020 06:18:14 GMT

Hi @keyu921,
probably the message field sould be already automatically extracted by Splunk because there's the pair key=value, if you cannot see it, use the Verbose Mode in search.

If not you can use a regex like this in the rex command or in a guided extraction:

(?ms)Message\=\"(?<Message>.+)\s+SID

that you can test at https://regex101.com/r/5X9OXT/1

Ciao.
Giuseppe

Re: eval or rex help

keyu921 — Thu, 21 May 2020 06:54:52 GMT

|rex Message=(?ms)Message=\"(?.+)\s+SID
But seems failed

Re: eval or rex help

gcusello — Thu, 21 May 2020 06:58:29 GMT

Hi @keyu921,
Try:

| rex "(?ms)Message\=\"(?<Message>.+)\s+SID"

P.S.: when you insert a code (like the regex) in a Question or in a Comment, use always the Code sample button (the one with 101010) otherwise your comment isn't readable.

Ciao.
Giuseppe

Re: eval or rex help

keyu921 — Thu, 21 May 2020 08:07:58 GMT

same result

Re: eval or rex help

keyu921 — Thu, 21 May 2020 08:21:24 GMT

it is ok now