topic Re: Extracting using rex in Splunk Search

Extracting using rex

rkris — Mon, 10 Aug 2020 20:37:52 GMT

How do I use rex to extract the virus info so that I can display this info in my splunk dashboard?

Re: Extracting using rex

impurush — Mon, 10 Aug 2020 20:44:18 GMT

Hi,

Do you want to get that "Virus" word in a separate field using rex command
or do you want to show the log details in the dashboard which has a virus word?

Re: Extracting using rex

isoutamo — Tue, 11 Aug 2020 05:42:27 GMT

getting the end of line after VIRUS - try the next

index=<YOUR INDEX HERE> source="General-linux-sql.log" sourcetype="Linux" Virus | rex "\s+VIRUS\s+-\s+(?<virusDescription>.*)" | table _time virusDescription

r. Ismo

Re: Extracting using rex

rkris — Mon, 10 Aug 2020 22:27:27 GMT

@impurush Hi. I just want to get "Possible NewApt.Worm - gadget.exe", "Possible Y2K Zelu Trojan", and "Possible NewApt.Worm - baby.exe"

Re: Extracting using rex

rkris — Mon, 10 Aug 2020 22:36:19 GMT

@isoutamo

I need to put the following line first as this is where i'll be retrieving my info from

So do i add your code after this line?

Re: Extracting using rex

impurush — Tue, 11 Aug 2020 00:10:23 GMT

Hi @rkris , use the below query to get all three "Possible NewApt.Worm - gadget.exe", "Possible Y2K Zelu Trojan", and "Possible NewApt.Worm - baby.exe" from the logs.

source="General-linux-sql.log" sourcetype="Linux" ("Possible NewApt.Worm - gadget.exe" OR "Possible Y2K Zelu Trojan" OR "Possible NewApt.Worm - baby.exe")

Re: Extracting using rex

rkris — Tue, 11 Aug 2020 02:36:00 GMT

@impurush

Is there a way for me to group them all into a table?

Re: Extracting using rex

impurush — Tue, 11 Aug 2020 02:59:27 GMT

@rkris , you can try this

source="General-linux-sql.log" sourcetype="Linux" ("Possible NewApt.Worm - gadget.exe" OR "Possible Y2K Zelu Trojan" OR "Possible NewApt.Worm - baby.exe") |rex field=_raw "Virus\s-\s(?<virus_name>.*)" | table _time,virus_name

Re: Extracting using rex

isoutamo — Tue, 11 Aug 2020 05:43:16 GMT

Yes add it to after those. You should always add at least

index=<your index> sourcetype=<your sourcetype> source=<your source> when you are looking events. And in this case add also word “Virus” as it would be on your each event.
That way your query is more powerful, quicker and use less resources.

I updated my previous example to contain these.

r. Ismo