topic Re: Help with regex in Splunk Search

Help with regex

surekhasplunk — Thu, 06 Aug 2020 11:41:40 GMT

Hi,

I have below in column default_message

1st regex :

default_message= <14>shell: cmd by abcd: mkdir test

can you please help me with the regex to extract user here and the command run by the user in another column command. We can consider the : as the delimiter after user

here i should be able to extract user=abcd and command=mkdir test

2nd regex :

default_message= <133>clish[1234]: User abcd finished running clish -c from CLI shell

same column we need to extract user=abcd and command=finished running clish -c from CLI shell

Please help me with the regex.

If we can combine above two it would be great. else i will have to use some case and then do the regex.

Thanks

Re: Help with regex

thambisetty — Thu, 06 Aug 2020 12:07:56 GMT

1st regex

|makeresults | eval _raw="default_message= <14>shell: cmd by abcd: mkdir test" | rex "cmd by (?<user>[^\:]+): (?<command>[^\s]+)"

2nd regex will combine both and work for 1st and second:

Re: Help with regex

surekhasplunk — Thu, 06 Aug 2020 12:04:08 GMT

Hi @thambisetty

Thanks for your quick reply.

It working well to extract user but command2 its showing only finished/running/logged.

whereas i want the full text after the user2 field form the column.

Re: Help with regex

thambisetty — Thu, 06 Aug 2020 12:06:52 GMT

check updated answer. I misunderstood.

------------------------------

up vote if it works.